CVE-2020-29312

9.8 criticalEPSS 1.3%

Critical (9.8) in zend zend framework. EPSS 1.3% chance of exploitation in the next 30 days.

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2023-04-04
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

zend:zend_framework

References

https://cowtransfer.com/s/f9684f004d7149
https://github.com/zendframework/zendframework
https://cowtransfer.com/s/f9684f004d7149
https://github.com/zendframework/zendframework

Check your stack JSON