Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/zendframework/zendframework1@1.10.0
purl pkg:composer/zendframework/zendframework1@1.10.0
Tags Ghost
Next non-vulnerable version 1.12.20
Latest non-vulnerable version 1.12.20
Risk 4.5
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-m1dk-ptr5-23c2
Aliases:
GHSA-qf36-fx9f-232x
ZendFramework potential SQL Injection Vector When Using PDO_MySql Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here: http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.
1.10.9
Affected by 0 other vulnerabilities.
1.11.6
Affected by 0 other vulnerabilities.
VCID-m1p7-zwwq-jbdg
Aliases:
ZF2011-02
Potential SQL Injection Vector When Using `PDO_MySql`.
1.12.0
Affected by 25 other vulnerabilities.
VCID-v3p7-aj4a-33d5
Aliases:
ZF2010-07
Cross-Site Scripting Potential Security Issues in Bundled Dojo Library.
1.12.0
Affected by 25 other vulnerabilities.
VCID-zghw-vr2u-pkf3
Aliases:
GHSA-w5mj-j45q-m638
ZendFramework1 Potential Security Issues in Bundled Dojo Library In mid-March, 2010, the Dojo Foundation issued a Security Advisory indicating potential security issues with specific files in Dojo Toolkit. Details of the advisory may be found on the Dojo website: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ In particular, several files in the Dojo tree were identified as having potential exploits, and the Dojo team also advised disabling or removing any PHP scripts in the tree when deploying to production.
1.10.3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T16:21:56.062009+00:00 GitLab Importer Affected by VCID-m1dk-ptr5-23c2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/zendframework/zendframework1/GHSA-qf36-fx9f-232x.yml 38.6.0
2026-06-04T16:21:54.884872+00:00 GitLab Importer Affected by VCID-zghw-vr2u-pkf3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/zendframework/zendframework1/GHSA-w5mj-j45q-m638.yml 38.6.0
2026-06-02T04:36:04.117790+00:00 GitLab Importer Affected by VCID-m1p7-zwwq-jbdg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/zendframework/zendframework1/ZF2011-02.yml 38.6.0
2026-06-02T04:36:03.506941+00:00 GitLab Importer Affected by VCID-v3p7-aj4a-33d5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/zendframework/zendframework1/ZF2010-07.yml 38.6.0