CVE-2015-5161: Zend Framework

Medium severity, CVSS 6.8. EPSS: 9.9% chance of exploitation in the next 30 days.

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

Affected products

• Zend Zend Framework: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.5.0 only; …

Published 2015-08-25. Last modified 2026-06-17.