VDB
CVE-2015-7695
CVE-2015-7695
PUBLISHED
CVSS 9.800000190734863 CRITICAL
The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.
EPSS 2.97% · 86.3th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.97%
86.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | zend-framework | 1.11.11-0ubuntu3, 1.11.11-0ubuntu2, 1.11.11-0ubuntu3.16.04.1 |
Timeline
- Jun 7, 2016 CVE Published
- Nov 28, 2016 CVE Updated
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2015-7695 third-party-advisory
- http://framework.zend.com/security/advisory/ZF2015-08 third-party-advisory
- https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2015-7695 third-party-advisory