zendframework/zend-db vulnerabilities

Latest zendframework/zend-db CVEs

Newest publication first

1. CVE-2014-8089 Zend Framework SQL injection vulnerability

   Published 2020-02-17

   Critical·CVSS 9.8 EPSS 2.6% PoC

   SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

2. CVE-2015-0270 Zend Framework Allows SQL Injection

   Published 2019-10-25

   Critical·CVSS 9.8 EPSS 1.1% PoC

   Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.