CVE-2025-32352: Zend Zendto

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.

Affected products

• Zend Zendto: before 5.04-7 (fixed in 5.04-7)

Published 2025-04-05. Last modified 2026-06-17.