GHSA-W2XX-JP9F-GP8G Yii Framework Cross-site Scripting Vulnerability

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

Yii Framework Reflected XSS

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

GHSA-4XH9-5VH8-3P58 Yii Framework Reflected XSS

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

Yii Cross-site Scripting Framework vulnerability

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

GHSA-4C64-W8FG-XCQ2 Yii Cross-site Scripting Framework vulnerability

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

GHSA-CWHM-272P-3WJ9 Yii Framework Cross-Site Request Forgery (CSRF)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

Yii Framework Cross-Site Request Forgery (CSRF)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

Yii Framework reflected Cross-site Scripting

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

GHSA-8GFQ-C54M-3RF6 Yii Framework reflected Cross-site Scripting

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2021-3692

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator...

The vulnerability of the PHP framework Yii, related to the restoration of unreliable data structures in memory, allows attackers to execute arbitrary code.

The vulnerability of the PHP framework Yii is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

Sql injection

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

Yii 2 Remote Code Execution Vulnerability

Yii Framework is a component-based , high-performance PHP framework for developing large-scale Web applications . A remote code execution vulnerability exists in Yii 2 versions prior to 2.0.38. The vulnerability can be exploited to achieve remote code execution via input containing a specially...

Possible remote code execution via unserialize() on user input containing specially crafted string

More info at https://www.yiiframework.com/news/303/yii-2-0-38...

PT-2020-6845 · Yii2 Gii · Yii2 Gii

Name of the Vulnerable Software and Affected Versions: Yii2 Gii versions prior to 2.2.2 Description: The issue allows remote attackers to execute arbitrary code via the messageCategory field in Generator.php. This can be done by embedding arbitrary PHP code into the model file. The vulnerability ...

Arbitrary File Deletion Vulnerability in iWebShop

iWebShop is an open source WEB e-commerce B2B2C building system based on the HP language and MYSQL database development , using the MVC architecture Yii framework thinking design mode of a product . iWebShop arbitrary file deletion vulnerability , an attacker can use the vulnerability to delete...

MyT Project Management 1.5.1 - Charge[group_total] SQL Injection

MyT Project Management 1.5.1 - Chargegrouptotal SQL Injection Exploit Title: MyT-PM 1.5.1 - 'Chargegrouptotal' SQL Injection Date: 03.01.2019 Exploit Author: Mehmet Önder Key Vendor Homepage: https://manageyourteam.net/ Software Link: https://sourceforge.net/projects/myt/ Version: v1.5.1 Category...