Technology · Packagist
zendframework/zendframework (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 23 vulnerabilities in zendframework/zendframework (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Zendframework URL Rewrite vulnerability, was published on 7 June 2024.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About zendframework/zendframework (Packagist)
Full-stack PHP web application framework and component library.
Latest zendframework/zendframework (Packagist) vulnerabilities
- Zendframework URL Rewrite vulnerabilitylowCVSS 3.1
- ZendFramework vulnerable to Cross-site ScriptinglowCVSS 3.1
- ZendFramework potential remote code execution in zend-mail via Sendmail adapterlowCVSS 3.1
- ZendFramework Potential Proxy Injection VulnerabilitieslowCVSS 3.1
- ZendFramework Information Disclosure and Insufficient Entropy vulnerabilitylowCVSS 3.1
- ZendFramework SQL injection due to execution of platform-specific SQL containing interpolationslowCVSS 3.1
- Zendframework vulnerable to XXE/XEE attackslowCVSS 3.1
- ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilitieslowCVSS 3.1
- Zendframework session validation vulnerabilitylowCVSS 3.1
- ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`lowCVSS 3.1
- Zendframework has potential Cross-site Scripting vector in multiple view helperslowCVSS 3.1
- Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress`lowCVSS 3.1
- CVE-2014-8089: Zend Framework SQL injection vulnerabilitylowCVSS 3.1EPSS 2.5%
- CVE-2015-3154: Zenario CMS vulnerable to CRLF injectionlowCVSS 3.1EPSS 1.0%
- CVE-2015-0270: Zend Framework Allows SQL InjectionlowCVSS 3.1EPSS 1.1%
- CVE-2015-5723: Doctrine Security Misconfiguration VulnerabilitylowCVSS 3EPSS 0.4%
- CVE-2015-5161: ZendXml and Zend Framework contain XXE and XEE VulnerabilitiesinfoEPSS 9.9%
- CVE-2015-1786: Zend Framework CSRF VulnerabilitylowCVSS 3EPSS 0.7%
- CVE-2014-8088: Zend Access Restriction BypassinfoEPSS 2.5%
- CVE-2015-7503: Zend Framework Information DisclosurelowCVSS 3EPSS 1.4%
- CVE-2016-4861: Zend Framework Allows SQL InjectionlowCVSS 3EPSS 4.1%
- CVE-2016-6233: Zend Framework Allows SQL InjectionlowCVSS 3EPSS 2.1%
- CVE-2021-3007: Remote code execution in zendframework and laminas-httplowCVSS 3.1EPSS 75.3%
Most severe zendframework/zendframework (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2021-3007: Remote code execution in zendframework and laminas-httplowCVSS 3.1EPSS 75.3%
- CVE-2014-8089: Zend Framework SQL injection vulnerabilitylowCVSS 3.1EPSS 2.5%
- CVE-2015-0270: Zend Framework Allows SQL InjectionlowCVSS 3.1EPSS 1.1%
- CVE-2015-3154: Zenario CMS vulnerable to CRLF injectionlowCVSS 3.1EPSS 1.0%
- Zendframework URL Rewrite vulnerabilitylowCVSS 3.1
- ZendFramework vulnerable to Cross-site ScriptinglowCVSS 3.1
- ZendFramework potential remote code execution in zend-mail via Sendmail adapterlowCVSS 3.1
- ZendFramework Potential Proxy Injection VulnerabilitieslowCVSS 3.1
- ZendFramework Information Disclosure and Insufficient Entropy vulnerabilitylowCVSS 3.1
- ZendFramework SQL injection due to execution of platform-specific SQL containing interpolationslowCVSS 3.1
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many zendframework/zendframework (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/zendframework-zendframework)<a href="https://junglewise.ai/threats/technologies/zendframework-zendframework"><img src="https://junglewise.ai/threats/technologies/zendframework-zendframework/badge.svg" alt="zendframework/zendframework (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/zendframework-zendframework.json, and this page as text at https://junglewise.ai/threats/technologies/zendframework-zendframework.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "zendframework/zendframework (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/zendframework-zendframework, 9 November 2026.