Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-t9je-wgtj-wufm
Vulnerability ID VCID-t9je-wgtj-wufm
Aliases GHSA-jq87-2wxp-8349
Summary ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://framework.zend.com/security/advisory/ZF2013-01
generic_textual HIGH https://framework.zend.com/security/advisory/ZF2013-01
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-jq87-2wxp-8349
cvssv3.1 7.5 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-01.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-01.yaml
cvssv3.1 7.5 https://github.com/zendframework/zendframework
generic_textual HIGH https://github.com/zendframework/zendframework
cvssv3.1 7.5 https://github.com/zendframework/zendframework/commit/0a7ec3407f02db29ea2ffd6daa71ead6fd151cfe
generic_textual HIGH https://github.com/zendframework/zendframework/commit/0a7ec3407f02db29ea2ffd6daa71ead6fd151cfe
cvssv3.1 7.5 https://github.com/zendframework/zendframework/commit/7fcb88ebc2d56f74aa943909f2b6b53f5c86b081
generic_textual HIGH https://github.com/zendframework/zendframework/commit/7fcb88ebc2d56f74aa943909f2b6b53f5c86b081
Reference id Reference type URL
https://framework.zend.com/security/advisory/ZF2013-01
https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-01.yaml
https://github.com/zendframework/zendframework/commit/0a7ec3407f02db29ea2ffd6daa71ead6fd151cfe
https://github.com/zendframework/zendframework/commit/7fcb88ebc2d56f74aa943909f2b6b53f5c86b081
GHSA-jq87-2wxp-8349 https://github.com/advisories/GHSA-jq87-2wxp-8349
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://framework.zend.com/security/advisory/ZF2013-01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2013-01.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zendframework/zendframework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zendframework/zendframework/commit/0a7ec3407f02db29ea2ffd6daa71ead6fd151cfe
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zendframework/zendframework/commit/7fcb88ebc2d56f74aa943909f2b6b53f5c86b081
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-11T20:35:16.471892+00:00 GHSA Importer Import https://github.com/advisories/GHSA-jq87-2wxp-8349 38.6.0