{"items":[{"id":"NVI-00007087","kind":"vulnerability","title":"ZendFramework potential SQL Injection Vector When Using PDO_MySql","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qf36-fx9f-232x"],"plain_summary":"OSV carries this publisher advisory for zendframework/zendframework1, zendframework/zendframework1. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.10.9 for zendframework/zendframework1. Confirm the publisher’s latest guidance.","source_ids":["sr-ce2d9ad264441e36aef0ee1996f1cd45"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.11.6 for zendframework/zendframework1. Confirm the publisher’s latest guidance.","source_ids":["sr-ce2d9ad264441e36aef0ee1996f1cd45"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ce2d9ad264441e36aef0ee1996f1cd45","url":"https://github.com/advisories/GHSA-qf36-fx9f-232x","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-qf36-fx9f-232x","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:31.002Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ce2d9ad264441e36aef0ee1996f1cd45"],"technology":"zendframework/zendframework1","known_exclusions":[],"conditions_summary":"Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:\n\nhttp://bugs.php.net/bug.php?id=47802\nThe PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.","public_affected_ranges":["ECOSYSTEM: introduced 1.10.0; fixed 1.10.9"]},{"certainty":"source_listed","source_ids":["sr-ce2d9ad264441e36aef0ee1996f1cd45"],"technology":"zendframework/zendframework1","known_exclusions":[],"conditions_summary":"Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:\n\nhttp://bugs.php.net/bug.php?id=47802\nThe PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on.","public_affected_ranges":["ECOSYSTEM: introduced 1.11.0; fixed 1.11.6"]}],"null_published_at":"2026-10-31T22:13:14.311Z","source_updated_at":"2024-06-07T21:13:11.000Z","source_disclosed_at":"2024-06-07T21:13:11.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:31.002Z"}],"next_cursor":null,"snapshot_revision":"42594"}