Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m522-m798-wff9
Vulnerability ID VCID-m522-m798-wff9
Aliases CVE-2014-8089
GHSA-qh9w-r7g5-q939
Summary SQL Injection SQL injection vector when manually quoting values for `sqlsrv` extension, using null byte.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://framework.zend.com/security/advisory/ZF2014-06
generic_textual CRITICAL http://framework.zend.com/security/advisory/ZF2014-06
epss 0.01121 https://api.first.org/data/v1/epss?cve=CVE-2014-8089
cvssv3.1 9.8 https://bugzilla.redhat.com/show_bug.cgi?id=1151277
generic_textual CRITICAL https://bugzilla.redhat.com/show_bug.cgi?id=1151277
cvssv3.1 9.8 http://seclists.org/oss-sec/2014/q4/276
generic_textual CRITICAL http://seclists.org/oss-sec/2014/q4/276
cvssv3.1 9.8 https://framework.zend.com/security/advisory/ZF2014-06
generic_textual CRITICAL https://framework.zend.com/security/advisory/ZF2014-06
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-qh9w-r7g5-q939
cvssv3.1 9.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml
generic_textual CRITICAL https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml
cvssv3.1 9.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml
generic_textual CRITICAL https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml
cvssv3.1 9.8 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml
generic_textual CRITICAL https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2014-8089
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2014-8089
cvssv3.1 9.8 http://www.securityfocus.com/bid/70011
generic_textual CRITICAL http://www.securityfocus.com/bid/70011
Reference id Reference type URL
http://framework.zend.com/security/advisory/ZF2014-06
https://api.first.org/data/v1/epss?cve=CVE-2014-8089
https://bugzilla.redhat.com/show_bug.cgi?id=1151277
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154
http://seclists.org/oss-sec/2014/q4/276
https://framework.zend.com/security/advisory/ZF2014-06
http://www.securityfocus.com/bid/70011
CVE-2014-8089 https://nvd.nist.gov/vuln/detail/CVE-2014-8089
CVE-2014-8089.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml
CVE-2014-8089.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml
CVE-2014-8089.YAML https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml
GHSA-qh9w-r7g5-q939 https://github.com/advisories/GHSA-qh9w-r7g5-q939
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://framework.zend.com/security/advisory/ZF2014-06
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1151277
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://seclists.org/oss-sec/2014/q4/276
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://framework.zend.com/security/advisory/ZF2014-06
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2014-8089
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/70011
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78562
EPSS Score 0.01121
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:52:09.350979+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/zendframework/zendframework1/CVE-2014-8089.yml 38.6.0