PT-2024-3969

Name of the Vulnerable Software and Affected Versions Yii2 versions 2.0.49.3 and earlier Description The issue lies in the mechanism for displaying function argument values in the stack trace, specifically when an argument's value exceeds 32 characters. The vulnerability manifests when an attacke...

Cross site scripting

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

PT-2018-17293

Name of the Vulnerable Software and Affected Versions: Yii Framework versions prior to 2.0.14 Description: The issue allows remote attackers to obtain potentially sensitive information from exception messages or exploit reflected XSS on the error handler page in non-debug mode. This is related to...

CVE-2018-6010: Improper Neutralization of Input During Web Page Generation

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...