TI-2011-01711 Aliases CVE-2011-1939 GHSA-v2wg-2jpv-87h6

SQL injection in zendframework;PHP zendframework

MEDIUM 49CWE-89Published 2019-11-26 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.

Why it matters now

EPSS 0.03858 90th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed zendframework (zendframework;PHP): 1.10.9, 1.11.6PHP (zendframework;PHP): 5.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zendframework;PHP	zendframework	1.10 to before 1.10.9; 1.11 to before 1.11.6	1.10.9, 1.11.6	Patch available	CNA
zendframework;PHP	PHP	before 5.3.6	5.3.6	Patch available	CNA

zendframework Vendorzendframework;PHP Affected 1.10 to before 1.10.9; 1.11 to before 1.11.6 Fixed in 1.10.9, 1.11.6 Patch available CNA
PHP Vendorzendframework;PHP Affected before 5.3.6 Fixed in 5.3.6 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:zend:zend_framework::::::::	1.10.0 to before 1.10.9; 1.11.0 to before 1.11.6	Vulnerable	Zend
cpe:2.3:a:php:php::::::::	before 5.3.6	Vulnerable	PHP
cpe:2.3:o:debian:debian_linux:8.0:::::::*	8.0	Vulnerable	Debian

cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:* Versions 1.10.0 to before 1.10.9; 1.11.0 to before 1.11.6 Vulnerable ·Zend
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions before 5.3.6 Vulnerable ·PHP
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

Fix · CNA zendframework (zendframework;PHP) Fixed in 1.10.9, 1.11.6
Fix · CNA PHP (zendframework;PHP) Fixed in 5.3.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2011-1939
2026-10-03 Alias added: GHSA-v2wg-2jpv-87h6
2026-10-14 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://bugs.php.net/bug.php?id=47802

Advisory 4

Other 1

https://access.redhat.com/security/cve/cve-2011-1939

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences