# zendframework/zendframework1 (Packagist) vulnerabilities 14 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/zendframework/zendframework1 ## Advisories (14) ### [CVE-2014-8089](https://cve.now/CVE-2014-8089): SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP… - Severity: Unrated - Published: Feb 17, 2020 - Affected: from 1.12.0, fixed in 1.12.9. ### [CVE-2015-3154](https://cve.now/CVE-2015-3154): CRLF injection vulnerability in Zend\\Mail (Zend\_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows… - Severity: Unrated - Published: Jan 27, 2020 - Affected: fixed in 1.12.12. ### [CVE-2016-6233](https://cve.now/CVE-2016-6233): The (1) order and (2) group methods in Zend\_Db\_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL… - Severity: Unrated - Published: Feb 16, 2017 - Affected: fixed in 1.12.19. ### [CVE-2015-7695](https://cve.now/CVE-2015-7695): The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute… - Severity: Unrated - Published: Jun 7, 2016 - Affected: fixed in 1.12.16. ### [CVE-2015-5723](https://cve.now/CVE-2015-5723): Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8… - Severity: Unrated - Published: Jun 7, 2016 - Affected: from 1.12.0, fixed in 1.12.16. ### [CVE-2015-5161](https://cve.now/CVE-2015-5161): The Zend\_Xml\_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when… - Severity: Unrated - Published: Aug 25, 2015 - Affected: from 1.12.0, fixed in 1.12.14. ### [CVE-2014-2683](https://cve.now/CVE-2014-2683): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest… - Severity: Unrated - Published: Nov 16, 2014 - Affected: fixed in 1.12.4. ### [CVE-2014-2682](https://cve.now/CVE-2014-2682): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest… - Severity: Unrated - Published: Nov 16, 2014 - Affected: fixed in 1.12.4. ### [CVE-2014-2681](https://cve.now/CVE-2014-2681): Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest… - Severity: Unrated - Published: Nov 16, 2014 - Affected: fixed in 1.12.4. ### [CVE-2014-8088](https://cve.now/CVE-2014-8088): The (1) Zend\_Ldap class in Zend before 1.12.9 and (2) Zend\\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote… - Severity: Unrated - Published: Oct 22, 2014 - Affected: from 1.12.0, fixed in 1.12.9. ### [CVE-2012-5657](https://cve.now/CVE-2012-5657): The (1) Zend\_Feed\_Rss and (2) Zend\_Feed\_Atom classes in Zend\_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow… - Severity: Unrated - Published: May 2, 2013 - Affected: fixed in 1.11.15; from 1.12.0-rc1, fixed in 1.12.1. ### [CVE-2012-6532](https://cve.now/CVE-2012-6532): (1) Zend\_Dom, (2) Zend\_Feed, (3) Zend\_Soap, and (4) Zend\_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote… - Severity: Unrated - Published: Feb 13, 2013 - Affected: from 1.0, fixed in 1.11.13; from 1.12.0-rc1, fixed in 1.12.0. ### [CVE-2012-6531](https://cve.now/CVE-2012-6531): (1) Zend\_Dom, (2) Zend\_Feed, and (3) Zend\_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle… - Severity: Unrated - Published: Feb 13, 2013 - Affected: from 1.0, fixed in 1.11.13; from 1.12.0-rc1, fixed in 1.12.0. ### [CVE-2012-3363](https://cve.now/CVE-2012-3363): Zend\_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows… - Severity: Critical 9.1 - Published: Feb 13, 2013 - Affected: from 1.0.0, fixed in 1.11.12; from 1.12.0-rc1, fixed in 1.12.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/zendframework/zendframework1 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.