CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

Cross site request forgery (csrf)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6010

CVE-2018-6010 affects Yii Framework 2.x up to and including 2.0.13 (fix in 2.0.14). The issue arises from the error handling path: remote attackers could obtain potentially sensitive information from exception messages and could exploit reflected XSS on the error handler page when running in non-...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x prior to 2.0.14, the switchIdentity() function in yii\web\User.php did not regenerate the CSRF token on identity changes, potentially allowing CSRF token mismatch after login state changes. Public advisories confirm this Cross‑Site Request Forgery risk. remediation: upgrade t...

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...

File Containment Vulnerability in iWebShop Open Source Mall System

iWebShop is an open source WEB e-commerce B2B2C platform self-supporting + merchants stationed station-building system based on PHP language + MYSQL database development, using the MVC architecture Yii framework thinking design pattern carefully designed a product. iWebShop open source mall syste...

Yii Framework Cross-Site Scripting Vulnerability (CNVD-2017-25538)

Yii Framework is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . Yii Framework 2.0.12 version of the framework/views/errorHandler/exception.php file has a cross-site scripting vulnerability , the vulnerability stems fr...

CVE-2017-11516

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

Cross site scripting

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

CVE-2017-11516

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

CVE-2017-11516

The CVE-2017-11516 entry describes an XSS in Yii Framework 2.0.12: framework/views/errorHandler/exception.php mishandles $exception->errorInfo, enabling XSS on the exception screen when debug mode is enabled. The description and related references indicate this is a framework component-level i...

CVE-2017-11516

An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception-errorInfo is mishandled...

Yii Framework Cross-Site Scripting Vulnerability

Yii Framework is the Yii team developed a set of component-based , PHP framework for developing Web applications . A cross-site scripting vulnerability exists in versions of Yii Framework prior to 2.0.11. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with...

CVE-2017-7271

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...