CVE-2023-50714

The vulnerability CVE-2023-50714 affects yii2-authclient (Yii framework 2.x) prior to version 2.2.15. The PKCE-protected OAuth2 implementation has two issues: (1) the authCodeVerifier should be removed after use (like authState), and (2) a downgrade attack risk if PKCE is relied upon for CSRF pro...

CVE-2023-50708 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison...

CVE-2023-50708 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison...

Yii Security Vulnerabilities

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii versions prior to 1.1.29, which stems from vulnerability to Remote Code Execution RCE attacks and may be exploited by attackers to...

Economizzer SQL Injection Vulnerability

Economizzer is a simple and open source personal finance management system using PHP Yii Framework 2 by Gustavo G. Andrade, an individual developer. A SQL injection vulnerability exists in Economizzer v.0.9-beta1. An attacker can exploit this vulnerability to conduct SQL injection attacks...

Yii Path Traversal Vulnerability

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii before version 2.0.5, which can be exploited to execute any local .php file via webViewAction...

CVE-2022-31454

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

Yii 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A cross-site scripting vulnerability exists in Yii 2 v2.0.45, which originates from endpoint books containing cross-site scripting XSS...

GHSA-GQ63-P39P-JRJF Withdrawn: SQL injection in Yii 2

Withdrawn Advisory This advisory has been withdrawn because the issue originates from a product built on Yii2, not the Yii2 Framework itself. This link is maintained to preserve external references. Original Description SQL injection vulnerability found in Yii Framework Yii 2 Framework before...

CVE-2023-26750

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

Sql injection

DISPUTED SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

Yii SQL注入漏洞

Yii is the YII team developed a set of component-based, high-performance PHP framework for developing large-scale Web applications. Yii Framework SQL injection vulnerability exists in Yii 2 Framework v.2.0.47 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary code...

PT-2023-20778 · Unknown · Yii 2 Framework

Name of the Vulnerable Software and Affected Versions: Yii 2 Framework versions prior to 2.0.47 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the runAction function. The software maintainer disputes that the vulnerability is in the framework itself,...

CVE-2023-26750

Summary of CVE-2023-26750 : Yii 2 Framework prior to 2.0.47 contains a SQL injection vulnerability in the runAction function that can allow a remote attacker to execute arbitrary code. The issue’s impact is described as critical. Remediation available: upgrade to Yii 2.0.47 or later. Some connect...

CVE-2023-26750

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

CVE-2023-26750

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

The vulnerability of the PHP framework Yii, related to the restoration of unreliable data structures in memory, allows attackers to execute arbitrary code.

The vulnerability of the PHP framework Yii is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Yii2 代码注入漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in Yii2 Gii versions prior to 2.2.2, which allows remote attackers to execute...

yii2 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale Web applications developed by the YII team. A cross-site scripting vulnerability exists in version 0.1.8 and earlier versions of yii2, which stems from incorrect manipulation of the parameter file resulting in...

Yii 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii Yii2 Gii 2.2.4 and earlier versions, which originates from a vulnerability that allows XSS attacks to be stored by injecting the...