Yii Framework Cross-site Scripting Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-3397 · ADVISORY
• FriendsOfPHP/security-advisories · WEB
• yiisoft/yii2 · WEB
• web.archive.org/web/20210122155403/http://www.securityfocus.com/bid/74663 · WEB
• yiiframework.com/news/86/yii-2-0-4-is-released · WEB
• securityfocus.com/bid/74663 · WEB
• yiiframework.com/news/86/yii-2-0-4-is-released · WEB
• yiiframework.com/news/86/yii-2-0-4-is-released · Patch

Weitere Schwachstellen in yiisoft/yii2

• CVE-2026-39850HOCH 7.4Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile()…
• CVE-2024-58136KRITISCH 9.8EXPLOITED (CISA KEV)Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i…
• CVE-2024-4990KRITISCH 9.1In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that th…
• CVE-2024-32877MITTEL 4.7Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scriptin…
• CVE-2015-5467KRITISCH 9.8web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter…