CVE-2012-4451
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow...
CVE-2012-4451 is a medium vulnerability (CVSS 6.1) in Zend Framework, published January 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in zendframework/zendframework1 1.11.4.
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
- Record
CVE-2012-4451- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
- Record
CVE-2012-4451- Updated
- 2026-11-02
EUVDEUVD-2012-4382 No score
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
- Record
EUVD-2012-4382- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g52p-86j5-xr8q
ZendFramework Potential Cross-site Scripting in Development Environment Error View Script
The default error handling view script generated using Zend_Tool failed to escape request parameters when run in the "development" configuration environment, providing a potential XSS attack vector.
Zend_Tool_Project_Context_Zf_ViewScriptFile was patched such that the view script template now calls the escape() method on dumped request variables.
Zend Framework 1.11.4 includes a patch that adds escaping to the generated error/error.phtml view script, ensuring that request variables are escaped appropriately for the browser. Do note, however, that this will not update any previously generated code. You will still need to follow the next advice for previously generated error view scripts.
- Record
GHSA-g52p-86j5-xr8q- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gff2-p6vm-3p8g
ZendFramework potential remote code execution in zend-mail via Sendmail adapter
When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.
- Record
GHSA-gff2-p6vm-3p8g- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3rph-pvh6-rj33 No score
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow...
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
- Record
GHSA-3rph-pvh6-rj33- Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-g52p-86j5-xr8q
ZendFramework Potential Cross-site Scripting in Development Environment Error View Script
The default error handling view script generated using Zend_Tool failed to escape request parameters when run in the "development" configuration environment, providing a potential XSS attack vector.
Zend_Tool_Project_Context_Zf_ViewScriptFile was patched such that the view script template now calls the escape() method on dumped request variables.
Zend Framework 1.11.4 includes a patch that adds escaping to the generated error/error.phtml view script, ensuring that request variables are escaped appropriately for the browser. Do note, however, that this will not update any previously generated code. You will still need to follow the next advice for previously generated error view scripts.
- Record
GHSA-g52p-86j5-xr8q- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-gff2-p6vm-3p8g
ZendFramework potential remote code execution in zend-mail via Sendmail adapter
When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.
- Record
GHSA-gff2-p6vm-3p8g- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-4451
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
- Record
UBUNTU-CVE-2012-4451- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1787582780 No score
TuxCare security update for zendframework/zendframework1 (6 CVEs)
TuxCare rebuilt zendframework/zendframework1 to address 6 CVEs. Fixed in 1.11.0-p4+tuxcare.
- Record
CLSA-2026-1787582780- Updated
- 2026-11-02
OSVCLSA-2026-1787781004 No score
TuxCare security update for zendframework/zendframework1 (5 CVEs)
TuxCare rebuilt zendframework/zendframework1 to address 5 CVEs. Fixed in 1.10.6-p3+tuxcare.
- Record
CLSA-2026-1787781004- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zendframework/zendframework1Packagist |
1.0.0 up to 1.11.4 | 1.11.4 |
zendframework/zendframeworkPackagist |
2.0.0 up to 2.4.11 | 2.4.11 |
zendframework/zendframework1TuxCare:Packagist |
1.11.0 up to 1.11.0-p4+tuxcare, plus listed versions 1.11.0-p1+tuxcare1.11.0-p2+tuxcare1.11.0-p3+tuxcare |
1.11.0-p4+tuxcare |
zendframework/zendframework1TuxCare:Packagist |
1.10.6 up to 1.10.6-p3+tuxcare, plus listed versions 1.10.6-p1+tuxcare1.10.6-p2+tuxcare |
1.10.6-p3+tuxcare |
zendframework/zendframeworkPackagist |
2.0.0 up to 2.4.11, plus listed versions 2.0.12.0.22.0.32.0.42.0.5 Show 45 moreShow less2.0.62.0.72.0.82.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.02.2.0rc12.2.0rc22.2.0rc32.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0rc12.4.0rc22.4.0rc32.4.0rc42.4.0rc52.4.0rc62.4.0rc72.4.12.4.102.4.2 |
2.4.11 |
zend-frameworkUbuntu:16.04:LTS |
All versions, plus listed versions 1.11.11-0ubuntu21.11.11-0ubuntu31.11.11-0ubuntu3.16.04.1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946
bugs.gentoo.org/show_bug.cgi?id=436210
seclists.org/oss-sec/2012/q3/571
framework.zend.com/security/advisory/ZF2012-03
bugzilla.redhat.com/show_bug.cgi?id=860738
Show 15 moreShow less
github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733
securityfocus.com/bid/55636
nvd.nist.gov/vuln/detail/CVE-2012-4451
web.archive.org/web/20210120123405/https://framework.zend.com/security/advisory/ZF2011-01
ubuntu.com/security/CVE-2012-4451
cve.org/CVERecord?id=CVE-2012-4451
Left out here: 7 versions. The JSON record has them.