zendframework/zend-view vulnerabilities

Latest zendframework/zend-view CVEs

Newest publication first

1. GHSA-m7hr-j867-3f34 ZendFramework has potential Cross-site Scripting vector in multiple view helpers

   Published 2024-06-07

   Medium·CVSS 6.1

   Many Zend Framework 2 view helpers were using the escapeHtml() view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr(). In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scrip...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.