CVE-2015-1786

Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.

• CWE-352

• https://bugzilla.redhat.com/show_bug.cgi?id=1207781Issue Tracking, Third Party Advisory, VDB Entry
• https://framework.zend.com/changelog/2.3.6Release Notes, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1207781Issue Tracking, Third Party Advisory, VDB Entry
• https://framework.zend.com/changelog/2.3.6Release Notes, Vendor Advisory

Published

Jun 8, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1780oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can a…6.5
• CVE-2015-1781Buffer overflow in the gethostbyname_r and other unspecified…
• CVE-2015-1782The kex_agree_methods function in libssh2 before 1.5.0 allow…
• CVE-2015-1783The prefix variable in the get_or_define_ns function in Lass…
• CVE-2015-1784In nextgen-galery wordpress plugin before 2.0.77.3 there are…8.8
• CVE-2015-1785In nextgen-galery wordpress plugin before 2.0.77.3 there are…6.5
• CVE-2015-1787The ssl3_get_client_key_exchange function in s3_srvr.c in Op…
• CVE-2015-1788The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenS…
• CVE-2015-1789The X509_cmp_time function in crypto/x509/x509_vfy.c in Open…
• CVE-2015-1790The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in O…
• CVE-2015-1791Race condition in the ssl3_get_new_session_ticket function i…
• CVE-2015-1792The do_free_upto function in crypto/cms/cms_smime.c in OpenS…