CVE-2014-2681: Several Zend Products Vulnerable to XXE and XEE attacks

medium Affects zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest, zendframework/zendservice-amazon, zendframework/zendservice-api, zendframework/zendservice-audioscrobbler and 4 more. Feed 2026.10.29.3, updated 2026-10-29; published 2022-05-14; advisory modified 2024-12-07.

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendframework1 Composer
Affected versions: <1.12.4
Fixed in: 1.12.4
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendopenid Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendrest Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-amazon Composer
Affected versions: <2.0.3
Fixed in: 2.0.3
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-api Composer
Affected versions: <1.0.0
Fixed in: 1.0.0
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-audioscrobbler Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-nirvanix Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-slideshare Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-technorati Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

Several Zend Products Vulnerable to XXE and XEE attacks

Package: zendframework/zendservice-windowsazure Composer
Affected versions: <2.0.2
Fixed in: 2.0.2
Severity: medium
Exploitation: not on CISA KEV · EPSS 3% (85.2th percentile)
Published: 2022-05-14
Source: osv.dev

References

CWE-611

NVD record zendframework/zendframework1 advisories zendframework/zendopenid advisories zendframework/zendrest advisories zendframework/zendservice-amazon advisories zendframework/zendservice-api advisories zendframework/zendservice-audioscrobbler advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2012-3363 high Zend Framework XXE Vulnerability same package: zendframework/zendframework1
CVE-2015-5161 medium ZendXml and Zend Framework contain XXE and XEE Vulnerabilities same package: zendframework/zendframework1
CVE-2015-7695 critical Zend Framework SQL injection vector using null byte for PDO same package: zendframework/zendframework1
CVE-2014-8089 critical Zend Framework SQL injection vulnerability same package: zendframework/zendframework1
CVE-2012-6531 medium Zend Framework XEE Vulnerability same package: zendframework/zendframework1
CVE-2014-8088 medium Anonymous authentication in ldap_bind() function of PHP, using null byte same package: zendframework/zendframework1