Read the docs
TI-2025-23435 Aliases CVE-2025-32352GHSA-2xch-5969-phfh

Type confusion in ZendTo

Priority MEDIUM 55CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed ZendTo (Zend): 5.04-7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZendZendTobefore 5.04-75.04-7Patch availableCNA
  • ZendTo VendorZend Affected before 5.04-7 Fixed in 5.04-7 Patch available CNA

Remediation

  • Fix · CNA ZendTo (Zend) Fixed in 5.04-7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32352
  2. 2026-10-03 Alias added: GHSA-2xch-5969-phfh

References

Other 1

  • TI-2021-22301 OS command injection in ZendTo CVSS 3.1CRITICAL 10.0
  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences