Sign in
Deutsch English Español Polski
Medium

ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

  • Disclosed: 17.05.2022
  • Updated: 11.10.2026 10:22

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package zendframework/zendframework >= 2.0.0, < 2.4.6, >= 2.5.0, < 2.5.2, >= 1.12.0, < 1.12.14 2.4.6, 2.5.2, 1.12.14
Composer package zendframework/zendframework1 >= 1.12.0, < 1.12.14 1.12.14
Composer package zendframework/zendxml >= 1.0.0, < 1.0.1 1.0.1

References

CVSS score -
Weakness (CWE)
CWE-611, CWE-776
Platform
Composer
Package
zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml
Disclosed
17.05.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xp8p-9rq5-4wgv - CC BY 4.0

Vulnerability history: zendframework/zendframework1

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (34) in the archive
Total entries
34
First → latest
05.2022 06.2024
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 9
  • Medium 17

Disclosures per year

Severity:
  1. Zendframework1 Potential SQL injection in ORDER and GROUP functions
    Critical · 9.8 ghsa-6fqw-j3vm-7f66 < 1.12.20 1.12.20
  2. Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
    High · 7.5 ghsa-848f-mph5-9pm9 >= 1.12.0, < 1.12.17 1.12.17
  3. ZendFramework1 Potential Insufficient Entropy Vulnerability
    High · 7.5 ghsa-8xhv-gqm4-3w99 >= 1.12.0, < 1.12.18 1.12.18
  4. Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
    Critical · 9.8 ghsa-v42g-7q2x-cw32 >= 1.12.0, < 1.12.16 1.12.16
  5. ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
    Critical · 9.8 ghsa-2x36-qhx3-7m5f >= 1.12.0, < 1.12.7 1.12.7
  6. Zendframework potential security issue in login mechanism
    High · 7.5 ghsa-9v78-h226-2rmq >= 1.12.0, < 1.12.4 1.12.4
  7. Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
    High · 8.6 ghsa-229x-22xc-2f2w >= 1.0.0, < 1.11.13 1.11.13
  8. Zendframework Denial of Service vector via XEE injection
    High · 7.5 ghsa-2jx7-xg83-j2m7 >= 1.0.0, < 1.11.13 1.11.13
  9. ZendFramework potential XML eXternal Entity injection vectors
    Critical · 9.8 ghsa-mhpx-3rv8-wrjm >= 1.12.0, < 1.12.4 1.12.4
  10. ZendFramework potential XML eXternal Entity injection vectors
    High · 7.5 ghsa-4j9x-g4x8-vcmf >= 1.11.0, < 1.11.15, >= 1.12.0, < 1.12.1 1.11.15, 1.12.1
  11. ZendFramework potential SQL Injection Vector When Using PDO_MySql
    Critical · 9.8 ghsa-qf36-fx9f-232x >= 1.10.0, < 1.10.9, >= 1.11.0, < 1.11.6 1.10.9, 1.11.6
  12. ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
    High · 7.5 ghsa-hx3m-959f-v849 >= 1.7.0, < 1.7.5 1.7.5
  13. Zend Framework SQL injection vulnerability
    Critical · 9.8 CVE-2014-8089 >= 1.12.0, < 1.12.9 1.12.9
  14. Zend Framework XXE Vulnerability
    High · 7.3 CVE-2012-3363 >= 1.0.0, < 1.11.12, >= 1.12.0-rc1, < 1.12.0 1.11.12, 1.12.0
  15. Doctrine Security Misconfiguration Vulnerability
    High · 7.8 CVE-2015-5723 >= 1.12.0, < 1.12.16 1.12.16
  16. Zend Framework SQL injection vector using null byte for PDO
    Critical · 9.8 CVE-2015-7695 < 1.12.16 1.12.16
  17. ZendXml and Zend Framework contain XXE and XEE Vulnerabilities this entry
    Medium CVE-2015-5161 >= 1.12.0, < 1.12.14 1.12.14
  18. Zend Framework Allows SQL Injection
    Critical · 9.8 CVE-2016-6233 < 1.12.19 1.12.19

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.