https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-29312.htmlhttps://patchthecve.com/cve/CVE-2020-29312.htmlThu, 09 Jul 2026 01:16:44 +0000CRITICAL 9.8: An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.https://patchthecve.com/cve/CVE-2021-3007.htmlhttps://patchthecve.com/cve/CVE-2021-3007.htmlWed, 17 Jun 2026 04:04:33 +0000CRITICAL 9.8: Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer suhttps://patchthecve.com/cve/CVE-2020-8986.htmlhttps://patchthecve.com/cve/CVE-2020-8986.htmlWed, 17 Jun 2026 03:27:18 +0000CRITICAL 9.8: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.https://patchthecve.com/cve/CVE-2020-8985.htmlhttps://patchthecve.com/cve/CVE-2020-8985.htmlWed, 17 Jun 2026 03:27:17 +0000HIGH 8.8: ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.https://patchthecve.com/cve/CVE-2020-8984.htmlhttps://patchthecve.com/cve/CVE-2020-8984.htmlWed, 17 Jun 2026 03:27:17 +0000HIGH 7.5: lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.https://patchthecve.com/cve/CVE-2014-8089.htmlhttps://patchthecve.com/cve/CVE-2014-8089.htmlWed, 17 Jun 2026 00:16:13 +0000CRITICAL 9.8: SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.https://patchthecve.com/cve/CVE-2012-4451.htmlhttps://patchthecve.com/cve/CVE-2012-4451.htmlTue, 16 Jun 2026 23:45:07 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) Vihttps://patchthecve.com/cve/CVE-2014-4913.htmlhttps://patchthecve.com/cve/CVE-2014-4913.htmlWed, 17 Jun 2026 00:10:47 +0000MEDIUM 6.1: ZF2014-03 has a potential cross site scripting vector in multiple view helpershttps://patchthecve.com/cve/CVE-2011-1939.htmlhttps://patchthecve.com/cve/CVE-2011-1939.htmlTue, 16 Jun 2026 23:30:25 +0000CRITICAL 9.8: SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.https://patchthecve.com/cve/CVE-2015-0270.htmlhttps://patchthecve.com/cve/CVE-2015-0270.htmlWed, 17 Jun 2026 00:19:52 +0000CRITICAL 9.8: Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.https://patchthecve.com/cve/CVE-2018-1000841.htmlhttps://patchthecve.com/cve/CVE-2018-1000841.htmlWed, 17 Jun 2026 01:33:09 +0000MEDIUM 6.1: Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability aphttps://patchthecve.com/cve/CVE-2018-10230.htmlhttps://patchthecve.com/cve/CVE-2018-10230.htmlWed, 17 Jun 2026 01:33:43 +0000MEDIUM 6.1: Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.https://patchthecve.com/cve/CVE-2014-4914.htmlhttps://patchthecve.com/cve/CVE-2014-4914.htmlWed, 17 Jun 2026 00:10:47 +0000CRITICAL 9.8: The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.https://patchthecve.com/cve/CVE-2015-7503.htmlhttps://patchthecve.com/cve/CVE-2015-7503.htmlWed, 17 Jun 2026 00:32:39 +0000HIGH 7.5: Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.https://patchthecve.com/cve/CVE-2015-3257.htmlhttps://patchthecve.com/cve/CVE-2015-3257.htmlWed, 17 Jun 2026 00:25:38 +0000MEDIUM 6.1: Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.https://patchthecve.com/cve/CVE-2015-1555.htmlhttps://patchthecve.com/cve/CVE-2015-1555.htmlWed, 17 Jun 2026 00:22:35 +0000CRITICAL 9.1: Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.https://patchthecve.com/cve/CVE-2015-1786.htmlhttps://patchthecve.com/cve/CVE-2015-1786.htmlWed, 17 Jun 2026 00:22:59 +0000HIGH 8.8: Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.https://patchthecve.com/cve/CVE-2016-6233.htmlhttps://patchthecve.com/cve/CVE-2016-6233.htmlWed, 17 Jun 2026 00:50:39 +0000CRITICAL 9.8: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.https://patchthecve.com/cve/CVE-2016-4861.htmlhttps://patchthecve.com/cve/CVE-2016-4861.htmlWed, 17 Jun 2026 00:48:20 +0000CRITICAL 9.8: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.https://patchthecve.com/cve/CVE-2016-10034.htmlhttps://patchthecve.com/cve/CVE-2016-10034.htmlWed, 17 Jun 2026 00:38:55 +0000CRITICAL 9.8: The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double qhttps://patchthecve.com/cve/CVE-2015-7695.htmlhttps://patchthecve.com/cve/CVE-2015-7695.htmlWed, 17 Jun 2026 00:32:58 +0000CRITICAL 9.8: The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.https://patchthecve.com/cve/CVE-2015-5723.htmlhttps://patchthecve.com/cve/CVE-2015-5723.htmlWed, 17 Jun 2026 00:29:39 +0000HIGH 7.8: Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local use