Read the docs
TI-2015-04329 Aliases CVE-2015-5161GHSA-xp8p-9rq5-4wgv

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14…

Priority MEDIUM 42CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

Why it matters now

EPSS 0.09867 95th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD and the CNA
Fix Fixed zendframework/zendframework (Packagist): 2.4.6, 2.5.2, 1.12.14zendframework/zendframework1 (Packagist): 1.12.14+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—zendframework/zendframework (Packagist)2.0.0 to before 2.4.62.4.6Patch availableGHSA-xp8p-9rq5-4wgv
—zendframework/zendframework (Packagist)2.5.0 to before 2.5.22.5.2Patch availableGHSA-xp8p-9rq5-4wgv
—zendframework/zendframework1 (Packagist)1.12.0 to before 1.12.141.12.14Patch availableGHSA-xp8p-9rq5-4wgv
—zendframework/zendxml (Packagist)1.0.0 to before 1.0.11.0.1Patch availableGHSA-xp8p-9rq5-4wgv
—zendframework/zendframework (Packagist)1.12.0 to before 1.12.141.12.14Patch availableGHSA-xp8p-9rq5-4wgv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • zendframework/zendframework (Packagist) Vendor— Affected 2.0.0 to before 2.4.6 Fixed in 2.4.6 Patch available GHSA-xp8p-9rq5-4wgv
  • zendframework/zendframework (Packagist) Vendor— Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-xp8p-9rq5-4wgv
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.12.0 to before 1.12.14 Fixed in 1.12.14 Patch available GHSA-xp8p-9rq5-4wgv
  • zendframework/zendxml (Packagist) Vendor— Affected 1.0.0 to before 1.0.1 Fixed in 1.0.1 Patch available GHSA-xp8p-9rq5-4wgv
  • zendframework/zendframework (Packagist) Vendor— Affected 1.12.0 to before 1.12.14 Fixed in 1.12.14 Patch available GHSA-xp8p-9rq5-4wgv

CPE configurations NVD · 154

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:*1.0.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:*1.0.0 rc2aVulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:*1.0.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:* Versions 1.0.0 rc2a Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·Zend
Show 144 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:*1.5.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:*1.6.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:*1.6.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:*1.6.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:*1.7.0 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:*1.7.0 prVulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:*1.7.3 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:*1.8.0 a1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:*1.8.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:*1.8.4 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:*1.9.0 a1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:*1.9.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:*1.9.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:*1.9.3 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*1.9.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*1.9.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*1.9.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:*1.10.0 alpha1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:*1.10.0 beta1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:*1.10.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*1.10.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*1.10.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*1.10.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*1.10.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*1.10.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*1.10.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*1.10.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*1.10.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:*1.10.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:*1.11.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:*1.11.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*1.11.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*1.11.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*1.11.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*1.11.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*1.11.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*1.11.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*1.11.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*1.11.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*1.11.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*1.11.10VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*1.11.11VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*1.11.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:*1.11.13VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:*1.12.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*1.12.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*1.12.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*1.12.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*1.12.0 rc4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:*1.12.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:*1.12.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.3:*:*:*:*:*:*:*1.12.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.4:*:*:*:*:*:*:*1.12.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.5:*:*:*:*:*:*:*1.12.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.6:*:*:*:*:*:*:*1.12.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.7:*:*:*:*:*:*:*1.12.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.8:*:*:*:*:*:*:*1.12.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.9:*:*:*:*:*:*:*1.12.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.10:*:*:*:*:*:*:*1.12.10VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.11:*:*:*:*:*:*:*1.12.11VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.12:*:*:*:*:*:*:*1.12.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.13:*:*:*:*:*:*:*1.12.13VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc3:*:*:*:*:*:*2.0.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc4:*:*:*:*:*:*2.0.0 rc4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc5:*:*:*:*:*:*2.0.0 rc5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc6:*:*:*:*:*:*2.0.0 rc6VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.0:rc7:*:*:*:*:*:*2.0.0 rc7VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableZend
cpe:2.3:a:zend:zend_framework:2.0.7:*:*:*:*:*:*:*2.0.7VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.3:*:*:*:*:*:*:*2.1.3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableZend
cpe:2.3:a:zend:zend_framework:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.5:*:*:*:*:*:*:*2.3.5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.6:*:*:*:*:*:*:*2.3.6VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.7:*:*:*:*:*:*:*2.3.7VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.8:*:*:*:*:*:*:*2.3.8VulnerableZend
cpe:2.3:a:zend:zend_framework:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.3:*:*:*:*:*:*:*2.4.3VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.4:*:*:*:*:*:*:*2.4.4VulnerableZend
cpe:2.3:a:zend:zend_framework:2.4.5:*:*:*:*:*:*:*2.4.5VulnerableZend
cpe:2.3:a:zend:zend_framework:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableZend
cpe:2.3:a:zend:zend_framework:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:* Versions 1.5.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:* Versions 1.6.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:* Versions 1.6.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:* Versions 1.6.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:* Versions 1.7.0 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:* Versions 1.7.0 pr Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:* Versions 1.7.3 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:* Versions 1.8.0 a1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:* Versions 1.8.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:* Versions 1.8.4 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:* Versions 1.9.0 a1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:* Versions 1.9.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:* Versions 1.9.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:* Versions 1.9.3 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:* Versions 1.10.0 alpha1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:* Versions 1.10.0 beta1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:* Versions 1.10.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:* Versions 1.10.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:* Versions 1.10.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:* Versions 1.10.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:* Versions 1.10.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:* Versions 1.10.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:* Versions 1.10.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:* Versions 1.10.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:* Versions 1.11.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:* Versions 1.11.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:* Versions 1.11.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:* Versions 1.11.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:* Versions 1.11.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:* Versions 1.11.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:* Versions 1.11.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:* Versions 1.11.11 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:* Versions 1.11.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:* Versions 1.11.13 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:* Versions 1.12.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:* Versions 1.12.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:* Versions 1.12.0 rc4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:* Versions 1.12.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:* Versions 1.12.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.3:*:*:*:*:*:*:* Versions 1.12.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.4:*:*:*:*:*:*:* Versions 1.12.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.5:*:*:*:*:*:*:* Versions 1.12.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.6:*:*:*:*:*:*:* Versions 1.12.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.7:*:*:*:*:*:*:* Versions 1.12.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.8:*:*:*:*:*:*:* Versions 1.12.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.9:*:*:*:*:*:*:* Versions 1.12.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.10:*:*:*:*:*:*:* Versions 1.12.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.11:*:*:*:*:*:*:* Versions 1.12.11 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.12:*:*:*:*:*:*:* Versions 1.12.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.13:*:*:*:*:*:*:* Versions 1.12.13 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc3:*:*:*:*:*:* Versions 2.0.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc4:*:*:*:*:*:* Versions 2.0.0 rc4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc5:*:*:*:*:*:* Versions 2.0.0 rc5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc6:*:*:*:*:*:* Versions 2.0.0 rc6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.0:rc7:*:*:*:*:*:* Versions 2.0.0 rc7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Zend

Remediation

  • Fix · GHSA-xp8p-9rq5-4wgv zendframework/zendframework (Packagist) Fixed in 2.4.6 Advisory →
  • Fix · GHSA-xp8p-9rq5-4wgv zendframework/zendframework (Packagist) Fixed in 2.5.2 Advisory →
  • Fix · GHSA-xp8p-9rq5-4wgv zendframework/zendframework1 (Packagist) Fixed in 1.12.14 Advisory →
  • Fix · GHSA-xp8p-9rq5-4wgv zendframework/zendxml (Packagist) Fixed in 1.0.1 Advisory →
  • Fix · GHSA-xp8p-9rq5-4wgv zendframework/zendframework (Packagist) Fixed in 1.12.14 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-5161
  2. 2026-10-03 Alias added: GHSA-xp8p-9rq5-4wgv

References

Exploit 4

Advisory 6

Other 9

  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
  • TI-2011-01711 SQL injection in zendframework;PHP zendframework CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences