CVE-2023-26750

Summary of CVE-2023-26750 : Yii 2 Framework prior to 2.0.47 contains a SQL injection vulnerability in the runAction function that can allow a remote attacker to execute arbitrary code. The issue’s impact is described as critical. Remediation available: upgrade to Yii 2.0.47 or later. Some connect...

CVE-2023-26750

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

The vulnerability of the PHP framework Yii, related to the restoration of unreliable data structures in memory, allows attackers to execute arbitrary code.

The vulnerability of the PHP framework Yii is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Yii2 代码注入漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in Yii2 Gii versions prior to 2.2.2, which allows remote attackers to execute...

yii2 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale Web applications developed by the YII team. A cross-site scripting vulnerability exists in version 0.1.8 and earlier versions of yii2, which stems from incorrect manipulation of the parameter file resulting in...

Yii 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii Yii2 Gii 2.2.4 and earlier versions, which originates from a vulnerability that allows XSS attacks to be stored by injecting the...

Craft CMS discloses password hashes

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

GHSA-H972-V458-M892 Craft CMS discloses password hashes

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

Cross site request forgery (csrf)

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

CVE-2022-37783

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

CVE-2022-37783

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

CVE-2022-37783

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

Yii 代码问题漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A code issue vulnerability exists in Yii versions prior to 1.1.27, which stems from a Remote Code Execution RCE attack by calling unserialize on arbitrary user input...

HumHub Cross-Site Scripting Vulnerability (CNVD-2022-82659)

HumHub is a set of open source social networking software written on the Yii PHP framework. HumHub suffers from a cross-site scripting vulnerability that stems from a component's lack of data filtering and escaping, which can be exploited by attackers to cause cross-site scripting...

HumHub 安全漏洞

Humhub is a set of open source social networking software written on the Yii PHP framework. HumHub has a security vulnerability that could be exploited by attackers to escalate privileges...

Yii Framework Code Injection

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

GHSA-M2P5-FWP2-QCW2 Yii Framework Code Injection

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

GHSA-W2XX-JP9F-GP8G Yii Framework Cross-site Scripting Vulnerability

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

Yii Framework Reflected XSS

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

GHSA-4XH9-5VH8-3P58 Yii Framework Reflected XSS

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...