Security

Security Advisories

Vulnerabilities reported against Zend Framework, and recommendations for mitigation

 ZF2019-01: Information disclosure in zend-developer-tools

Published 2019-03-28

 ZF2018-01: URL rewrite vulnerability

Published 2018-08-01

 ZF2016-04: Potential remote code execution in zend-mail via Sendmail adapter

Published 2016-12-20

 ZF2016-03: Potential SQL injection in ORDER and GROUP functions of ZF1

Published 2016-09-08

 ZF2016-02: Potential SQL injection in ORDER and GROUP statements of Zend_Db_Select

Published 2016-07-13

 ZF2016-01: Potential Insufficient Entropy Vulnerability in Zend Framework 1

Published 2016-04-13

 ZF2015-09: Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

Published 2015-11-23

 ZF2015-10: Potential Information Disclosure in Zend\Crypt\PublicKey\Rsa\PublicKey

Published 2015-11-23

 ZF2015-07: Filesystem Permissions Issues in Multiple Components

Published 2015-09-15

 ZF2015-08: Potential SQL injection vector using null byte for PDO (MsSql, SQLite)

Published 2015-09-15

Have you identified a security vulnerability?

Please report it to us at zf-security@zend.com

About
Overview
FAQ
License
Changelog
Security
Issues

Install
Get started
MVC skeleton app
Expressive skeleton app
Archives

Documentation
Overview
Training and Certification
Support and Consulting
Webinars
Blog
Zend Framework 2 - API
Zend Framework 1 - API

Participate
Overview
Slack
Forums
Contributor guide
Code Manifesto
Contributors
Logos
Get certified
Privacy Policy

Copyright

© 2006-2022 by Zend by Perforce. Made with by awesome contributors.

This website is built using zend-expressive and it runs on PHP 7.

Contacts