Reflected cross-site scripting (XSS) In zendframework/zendframework1
Description
Zendframework potential Cross-site Scripting vector in Zend_Service_ReCaptcha_MailHide
Zend_Service_ReCaptcha_MailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities() did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted multibyte string as an attack via the CAPTCHA's email argument
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 1.7.9, 1.8.5, 1.9.7 |
Aliases
1.
References
1. 2.