Composer zendframework/zendframework1 has 54 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2012-3363 | Zend Framework XXE Vulnerability | high | 7.3 | >=1.0.0 and <1.11.12 or >=1.12.0-rc1 and <1.12.0 | 1.11.12, 1.12.0 |
| CVE-2015-5161 | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | >=1.12.0 and <1.12.14 | 1.12.14 |
| CVE-2015-7695 | Zend Framework SQL injection vector using null byte for PDO | critical | 9.8 | <1.12.16 | 1.12.16 |
| CVE-2014-2681 | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | <1.12.4 | 1.12.4 |
| CVE-2014-8089 | Zend Framework SQL injection vulnerability | critical | 9.8 | >=1.12.0 and <1.12.9 | 1.12.9 |
| CVE-2012-6531 | Zend Framework XEE Vulnerability | medium | 0.0 | >=1.0 and <1.11.13 or >=1.12.0-rc1 and <1.12.0 | 1.11.13, 1.12.0 |
| CVE-2014-8088 | Zend Access Restriction Bypass | medium | 0.0 | >=1.12.0 and <1.12.9 | 1.12.9 |
| CVE-2014-2683 | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | <1.12.4 | 1.12.4 |
| CVE-2014-2682 | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | <1.12.4 | 1.12.4 |
| CVE-2016-6233 | Zend Framework Allows SQL Injection | critical | 9.8 | <1.12.19 | 1.12.19 |
| CVE-2012-6532 | Zend Framework XEE Vulnerability | medium | 0.0 | >=1.0 and <1.11.13 or >=1.12.0-rc1 and <1.12.0 | 1.11.13, 1.12.0 |
| CVE-2012-5657 | Zend Framework XXE Vulnerability | medium | 0.0 | <1.11.15 or >=1.12.0-rc1 and <1.12.1 | 1.11.15, 1.12.1 |
| CVE-2015-3154 | Zenario CMS vulnerable to CRLF injection | medium | 6.1 | <1.12.12 or >=1.12.0 and <1.12.12 | 1.12.12 |
| CVE-2015-5723 | Doctrine Security Misconfiguration Vulnerability | high | 7.8 | >=1.12.0 and <1.12.16 | 1.12.16 |
| GHSA-2x36-qhx3-7m5f | ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | critical | 9.8 | >=1.12.0 and <1.12.7 | 1.12.7 |
| GHSA-6fqw-j3vm-7f66 | Zendframework1 Potential SQL injection in ORDER and GROUP functions | critical | 9.8 | <1.12.20 | 1.12.20 |
| GHSA-mhpx-3rv8-wrjm | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | >=1.12.0 and <1.12.4 | 1.12.4 |
| GHSA-qf36-fx9f-232x | ZendFramework potential SQL Injection Vector When Using PDO_MySql | critical | 9.8 | >=1.10.0 and <1.10.9 or >=1.11.0 and <1.11.6 | 1.10.9, 1.11.6 |
| GHSA-v42g-7q2x-cw32 | Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | critical | 9.8 | >=1.12.0 and <1.12.16 | 1.12.16 |
| GHSA-229x-22xc-2f2w | Zendframework Local file disclosure via XXE injection in Zend_XmlRpc | high | 8.6 | >=1.0.0 and <1.11.13 | 1.11.13 |
| GHSA-2jx7-xg83-j2m7 | Zendframework Denial of Service vector via XEE injection | high | 7.5 | >=1.0.0 and <1.11.13 | 1.11.13 |
| GHSA-4j9x-g4x8-vcmf | ZendFramework potential XML eXternal Entity injection vectors | high | 7.5 | >=1.11.0 and <1.11.15 or >=1.12.0 and <1.12.1 | 1.11.15, 1.12.1 |
| GHSA-848f-mph5-9pm9 | Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | high | 7.5 | >=1.12.0 and <1.12.17 | 1.12.17 |
| GHSA-8xhv-gqm4-3w99 | ZendFramework1 Potential Insufficient Entropy Vulnerability | high | 7.5 | >=1.12.0 and <1.12.18 | 1.12.18 |
| GHSA-9v78-h226-2rmq | Zendframework potential security issue in login mechanism | high | 7.5 | >=1.12.0 and <1.12.4 | 1.12.4 |
| GHSA-hx3m-959f-v849 | ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` | high | 7.5 | >=1.7.0 and <1.7.5 | 1.7.5 |
| GHSA-4v57-pwvf-x35j | Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | medium | 6.1 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| GHSA-4vf6-mq7w-3hp6 | Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | medium | 6.1 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| GHSA-g52p-86j5-xr8q | ZendFramework Potential Cross-site Scripting in Development Environment Error View Script | medium | 6.1 | >=1.0.0 and <1.11.4 | 1.11.4 |
| GHSA-gwpm-pm6x-h7rj | ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` | medium | 6.1 | >=1.7.0 and <1.7.6 | 1.7.6 |
| GHSA-hg35-vqp3-fv39 | ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings | medium | 6.1 | >=1.9.0 and <1.9.7 | 1.9.7 |
| GHSA-j543-vg33-g6vj | ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` | medium | 6.1 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| GHSA-vvm3-rv48-j3g5 | Zendframework Potential XSS or HTML Injection vector in Zend_Json | medium | 6.1 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| GHSA-w5mj-j45q-m638 | ZendFramework1 Potential Security Issues in Bundled Dojo Library | medium | 0.0 | >=1.9.0 and <1.9.8 or >=1.10.0 and <1.10.3 | 1.9.8, 1.10.3 |
| ZF2009-01 | LFI vector in Zend_View::setScriptPath() and render() | unknown | 0.0 | >=1.7.0 and <1.7.5 | 1.7.5 |
| ZF2009-02 | XSS vector in Zend_Filter_StripTags | unknown | 0.0 | >=1.7.0 and <1.7.6 | 1.7.6 |
| ZF2010-01 | Potential XSS vectors due to inconsistent encodings | unknown | 0.0 | >=1.9.0 and <1.9.7 | 1.9.7 |
| ZF2010-02 | Potential XSS vector in Zend_Dojo_View_Helper_Editor | unknown | 0.0 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| ZF2010-03 | Potential XSS vector in Zend_Filter_StripTags when comments allowed | unknown | 0.0 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| ZF2010-05 | Potential XSS vector in Zend_Service_ReCaptcha_MailHide | unknown | 0.0 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| ZF2010-06 | Potential Security Issues in Bundled Dojo Library | unknown | 0.0 | >=1.7.0 and <1.7.9 or >=1.8.0 and <1.8.5 or >=1.9.0 and <1.9.7 | 1.7.9, 1.8.5, 1.9.7 |
| ZF2010-07 | Potential Security Issues in Bundled Dojo Library | unknown | 0.0 | >=1.9.0 and <1.9.8 or >=1.10.0 and <1.10.3 | 1.9.8, 1.10.3 |
| ZF2011-01 | Potential XSS in Development Environment Error View Script | unknown | 0.0 | >=1.0.0 and <1.11.4 | 1.11.4 |
| ZF2011-02 | Potential SQL Injection Vector When Using PDO_MySql | unknown | 0.0 | >=1.10.0 and <1.10.9 or >=1.11.0 and <1.11.6 | 1.10.9, 1.11.6 |
| ZF2012-01 | Local file disclosure via XXE injection in Zend_XmlRpc | unknown | 0.0 | >=1.0.0 and <1.11.13 | 1.11.13 |
| ZF2012-02 | Denial of Service vector via XEE injection | unknown | 0.0 | >=1.0.0 and <1.11.13 | 1.11.13 |
| ZF2012-05 | Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component | unknown | 0.0 | >=1.11.0 and <1.11.15 or >=1.12.0 and <1.12.1 | 1.11.15, 1.12.1 |
| ZF2014-01 | Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse | unknown | 0.0 | >=1.12.0 and <1.12.4 | 1.12.4 |
| ZF2014-02 | Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer | unknown | 0.0 | >=1.12.0 and <1.12.4 | 1.12.4 |
| ZF2014-04 | Potential SQL injection in the ORDER implementation of Zend_Db_Select | unknown | 0.0 | >=1.12.0 and <1.12.7 | 1.12.7 |
| ZF2015-08 | Potential SQL injection vector using null byte for PDO (MsSql, SQLite) | unknown | 0.0 | >=1.12.0 and <1.12.16 | 1.12.16 |
| ZF2015-09 | Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word | unknown | 0.0 | >=1.12.0 and <1.12.17 | 1.12.17 |
| ZF2016-01 | Potential Insufficient Entropy Vulnerability in ZF1 | unknown | 0.0 | >=1.12.0 and <1.12.18 | 1.12.18 |
| ZF2016-03 | Potential SQL injection in ORDER and GROUP functions of ZF1 | unknown | 0.0 | <1.12.20 | 1.12.20 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked