CVE-2022-48197

CVE-2022-48197 Since Yahoo is no longer updating the project per this announcement: https://yahooeng.tumblr.com/post/96098168666/important-announcement-regarding-yui, I've decided to disclose the vulnerabilities here: The application has a lot of reflected XSS vulnerabilities in pretty much most...

Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting

Reflected cross-site scripting XSS exists in the TreeView of YUI2 through 2800: up.php sam.php renderhidden.php removechildren.php removeall.php readd.php overflow.php newnode2.php newnode.php. id: CVE-2022-48197 info: name: Yahoo User Interface library YUI2 TreeView v2.8.2 - Cross-Site Scripting...

CLSA-2026-1773965916 TuxCare security update for yui2 (1 CVE)

TuxCare rebuilt yui2 to address 1 CVE. Fixed in 2.9.0-tuxcare.1...

PT-2026-74037

TuxCare rebuilt yui2 to address 1 CVE. Fixed in 2.9.0-tuxcare.1...

Malicious code in yui2-animation (npm)

The package yui2-animation was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 075f8fc51a15a005755c226c80fb0355dda105449ade6f949deced74ddbd7b56 Any computer that has this package installed or running should be considered fully...

MAL-2025-42157 Malicious code in yui2-animation (npm)

The package yui2-animation was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 075f8fc51a15a005755c226c80fb0355dda105449ade6f949deced74ddbd7b56 Any computer that has this package installed or running should be considered fully...

Malware in yui2-animation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in yui2-treeview

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview yui2-treeview is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-42158 Malicious code in yui2-treeview (npm)

The package yui2-treeview was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe84263428228e04358ddd36ac76a8372fa21980918b3a9acd4144397683ea32 Any computer that has this package installed or running should be considered fully...

Malicious code in yui2-treeview (npm)

The package yui2-treeview was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe84263428228e04358ddd36ac76a8372fa21980918b3a9acd4144397683ea32 Any computer that has this package installed or running should be considered fully...

CVE-2022-48197

Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Yahoo User Interface TreeView 2.8.2 Cross Site Scripting

Exploit Title: Yahoo User Interface library YUI2 TreeView v2.8.2 - Multiple Reflected Cross Site Scripting XSS Google Dork: N/A Date: 2/1/2023 Exploit Author: Rian Saaty Vendor Homepage: https://yui.github.io/yui2/ Software Link: https://yui.github.io/yui2/ Version: 2.8.2 Tested on: MacOS,...

Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS)

Exploit Title: Yahoo User Interface library YUI2 TreeView v2.8.2 - Multiple Reflected Cross Site Scripting XSS Google Dork: N/A Date: 2/1/2023 Exploit Author: Rian Saaty Vendor Homepage: https://yui.github.io/yui2/ Software Link: https://yui.github.io/yui2/ Version: 2.8.2 Tested on: MacOS,...

CVE-2022-48197

Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2022-48197

Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Cross site scripting

Reflected cross-site scripting XSS exists in the TreeView of YUI2 through 2800: up.php sam.php renderhidden.php removechildren.php removeall.php readd.php overflow.php newnode2.php newnode.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2022-48197: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2023-15613 · Yui2 · Yui2

Name of the Vulnerable Software and Affected Versions: YUI2 affected versions not specified Description: Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component, and the YUI Javascript library overall are not affected...

CVE-2022-48197

Reflected cross-site scripting XSS exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...