彙總 zend 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 輸入驗證問題、XXE與緩衝區溢位 相關，可能在 軟體部署與生產負載 場景中帶來 應用程式崩潰與記憶體損壞 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-34508 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service. | [email protected] | 5.3 | 64.24% | 2025-06-17 | 2026-06-17 |
| CVE-2025-32352 | A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt. | [email protected] | 4.8 | 0.27% | 2025-04-05 | 2026-06-17 |
| CVE-2021-47667 | An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request. | [email protected] | 10.0 | 29.77% | 2025-04-05 | 2026-06-17 |
| CVE-2020-29312 | An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020. | [email protected] | 9.8 | 1.26% | 2023-04-04 | 2026-07-08 |
| CVE-2021-27888 | ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters. | [email protected] | 6.1 | 0.62% | 2021-03-01 | 2026-06-16 |
| CVE-2021-3007 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommen | [email protected] | 9.8 | 75.31% | 2021-01-03 | 2026-06-17 |
| CVE-2020-8986 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests. | [email protected] | 9.8 | 1.54% | 2020-03-24 | 2026-06-16 |
| CVE-2020-8985 | ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality. | [email protected] | 8.8 | 0.51% | 2020-03-24 | 2026-06-16 |
| CVE-2020-8984 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. | [email protected] | 7.5 | 0.49% | 2020-03-24 | 2026-06-16 |
| CVE-2014-8089 | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. | [email protected] | 9.8 | 2.55% | 2020-02-17 | 2026-06-16 |
| CVE-2015-3154 | CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email. | [email protected] | 6.1 | 1.01% | 2020-01-27 | 2026-06-16 |
| CVE-2012-4451 | Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper. | [email protected] | 6.1 | 1.37% | 2020-01-03 | 2026-06-16 |
| CVE-2014-4913 | ZF2014-03 has a potential cross site scripting vector in multiple view helpers | [email protected] | 6.1 | 1.21% | 2019-12-15 | 2026-06-16 |
| CVE-2011-1939 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6. | [email protected] | 9.8 | 3.86% | 2019-11-26 | 2026-06-16 |
| CVE-2015-0270 | Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. | [email protected] | 9.8 | 1.10% | 2019-10-25 | 2026-06-16 |
| CVE-2018-1000841 | Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability appears to have been fixed in 5.16-1 Beta. | [email protected] | 6.1 | 0.70% | 2018-12-20 | 2026-06-16 |
| CVE-2018-10230 | Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455. | [email protected] | 6.1 | 2.71% | 2018-04-19 | 2026-06-16 |
| CVE-2014-4914 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. | [email protected] | 9.8 | 2.31% | 2017-12-29 | 2026-06-16 |
| CVE-2015-7503 | Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key. | [email protected] | 7.5 | 1.36% | 2017-10-10 | 2026-06-16 |
| CVE-2015-3257 | Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks. | [email protected] | 6.1 | 0.91% | 2017-08-25 | 2026-06-16 |