Vulnerabilities > Zend > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-04-04 CVE-2020-29312 Deserialization of Untrusted Data vulnerability in Zend Framework
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function.
network
low complexity
zend CWE-502
critical
9.8
2021-01-04 CVE-2021-3007 Deserialization of Untrusted Data vulnerability in multiple products
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php.
network
low complexity
getlaminas zend CWE-502
critical
9.8
2020-03-24 CVE-2020-8986 Improper Check for Unusual or Exceptional Conditions vulnerability in Zend Zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
network
low complexity
zend CWE-754
critical
9.8
2020-02-17 CVE-2014-8089 SQL Injection vulnerability in multiple products
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
network
low complexity
zend redhat fedoraproject CWE-89
critical
9.8
2019-11-26 CVE-2011-1939 SQL Injection vulnerability in multiple products
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
network
low complexity
zend php debian CWE-89
critical
9.8
2019-10-25 CVE-2015-0270 SQL Injection vulnerability in Zend Framework
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
network
low complexity
zend CWE-89
critical
9.8
2017-12-29 CVE-2014-4914 SQL Injection vulnerability in multiple products
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
network
low complexity
zend debian CWE-89
critical
9.8
2017-08-07 CVE-2015-1555 Improper Input Validation vulnerability in Zend Framework
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
network
low complexity
zend CWE-20
critical
9.1
2017-02-17 CVE-2016-6233 SQL Injection vulnerability in multiple products
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
network
low complexity
fedoraproject zend CWE-89
critical
9.8
2017-02-17 CVE-2016-4861 SQL Injection vulnerability in multiple products
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
network
low complexity
fedoraproject zend CWE-89
critical
9.8