Vulnerabilities > Zend > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-04-04 CVE-2020-29312 Deserialization of Untrusted Data vulnerability in Zend Framework
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function.
network
low complexity
zend CWE-502
critical
9.8
2021-01-04 CVE-2021-3007 Deserialization of Untrusted Data vulnerability in multiple products
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php.
network
low complexity
getlaminas zend CWE-502
critical
9.8
2017-02-17 CVE-2016-6233 SQL Injection vulnerability in multiple products
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
network
low complexity
fedoraproject zend CWE-89
critical
9.8
2017-02-17 CVE-2016-4861 SQL Injection vulnerability in multiple products
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
network
low complexity
fedoraproject zend CWE-89
critical
9.8
2013-02-13 CVE-2012-3363 XXE vulnerability in multiple products
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
network
low complexity
zend fedoraproject debian CWE-611
critical
9.1