Skip to content
OpenAdvisories
Critical DLA-646-1 1 CVE

zendframework - security update

Published Oct 5, 2016 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 zendframework 1.11.13-1.1+deb7u5

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-4861 Public exploit

    Zend Framework Allows SQL Injection

    The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

    zendframework/zendframework zend-framework Ubuntu Packagist