peter bassill · operator
$ cve CVE-2016-4861 JSON

CVE-2016-4861

9.8
CRITICAL · CVSS 3.0 · EPSS 4.1% (pctl 91)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS4.12% — more likely to be exploited than 91% of all CVEs
WeaknessCWE-89
On CISA KEVno
Public exploitnone known
Published2017-02-17
Last modified2026-06-17

Affected (2)

VendorProduct
fedoraprojectfedora
zendzend framework

References

→ the Explorer  ·  watch your stack  ·  NVD