CVE-2015-3397

Cross-site scripting XSS vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

Yii Framwork CmsInput Improper XSS Filter

Yii framework CmsInput extension 1 improper XSS sanitation + Discovered by: Jos Wetzels + Affects: Yii framework CmsInput extension xssClean$this-stripTags$str; What happens is that stripTags is called on the user-supplied input before xssClean is called. stripTags is designed to eliminate all...

Yii Framework 1.1.8 Search SQL Injection Vulnerability

No description provided by source. Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another versi...

The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property

More info at https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/...

Yii Framework Blog Cross Site Request Forgery

Exploit Title: Yii Framework Blog Application CSRF Vulnerability Date: 3 Mar 2014 Author: Christy Philip Mathew Demo: Yii Blog Application - http://www.yiiframework.com/demos/blog/ Category:: web Tested on: Windows 8 Attacker will be able to create a post...

Yii Framework 'Search'表单字段SQL注入漏洞

BUGTRAQ ID: 56620 Yii Framework是一个基于组件、用于开发大型Web应用的高性能PHP框架。 Yii Framework 1.1.8及其他版本存在SQL注入漏洞，成功利用后可允许攻击者控制应用、访问或修改数据、利用下层数据库内的其他潜在漏洞。 0 Yii Framework 1.1.8 厂商补丁： yiiframework ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.yiiframework.com/...

Yii Framework 1.1.8 Search SQL Injection

Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another version Vulnerability: SQL Injection via...

Yii Framework 1.1.8 Search SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8...

Yii Framework 1.1.8 - Search SQL Injection

Exploit Title: Yii Framework - Search SQL Injection Vulnerability Google Dork: No Dork Date: 20/11/2012 Exploit Author: Junookyo Vendor Homepage: http://www.yiiframework.com/ Software Link: http://www.yiiframework.com/download/ Version: 1.1.8 maybe another version Vulnerability: SQL Injection via...