Yii Framework Cross-Site Scripting Vulnerability

Yii Framework is the Yii team developed a set of component-based , PHP framework for developing Web applications . A cross-site scripting vulnerability exists in versions of Yii Framework prior to 2.0.11. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with...

CVE-2017-7271

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

CVE-2017-7271

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

CVE-2017-7271

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

CVE-2017-7271

CVE-2017-7271 describes a reflected XSS in the Yii Framework prior to 2.0.11. In development mode, crafted request data can be mishandled on the debug-mode exception screen, allowing remote attackers to inject arbitrary script/HTML. Affected product/version: Yii Framework before 2.0.11 (developme...

Open Real Estate 1.15.1 XSS / SQL Injection / Weak Hashing

Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for...

class yii\web\ViewAction allowed to include arbitrary files that end with .php

More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...

class yii\web\ViewAction allowed to include arbitrary files that end with .php

More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...

Yii Framework Cross-Site Scripting Vulnerability

Yii Framework is a component-based , high-performance PHP framework for developing large-scale Web applications . A cross-site scripting vulnerability exists in versions of Yii Framework prior to 2.0.4 that allows remote attackers to inject arbitrary web script or HTML via vector-related JSON...

CVE-2015-3397

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

Cross site scripting

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

CVE-2015-3397

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

CVE-2015-3397

The CVE-2015-3397 issue affects the Yii Framework prior to 2.0.4, where an XSS flaw could be exploited by remote attackers via JSON/arrays, particularly affecting Internet Explorer 6/7. The vulnerability arises in how JSON data is handled when rendered, allowing injection of arbitrary web script ...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

Yii Framwork CmsInput Improper XSS Filter

Yii framework CmsInput extension 1 improper XSS sanitation + Discovered by: Jos Wetzels + Affects: Yii framework CmsInput extension xssClean$this-stripTags$str; What happens is that stripTags is called on the user-supplied input before xssClean is called. stripTags is designed to eliminate all...

Yii Framework 1.1.8 Search SQL Injection Vulnerability

No description provided by source. Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another versi...

The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property

More info at https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/...