Yii Framework Cross-Site Request Forgery (CSRF)

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-6009 · ADVISORY
• yiisoft/yii2 commit 6c0540a · WEB
• FriendsOfPHP/security-advisories · WEB
• FriendsOfPHP/security-advisories · WEB
• yiisoft/yii2-framework · PACKAGE
• yiiframework.com/news/165/yii-2-0-14-is-released · WEB

Autres vulnérabilités de yiisoft/yii2

• CVE-2026-39850ÉLEVÉE 7.4Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile()…
• CVE-2024-58136CRITIQUE 9.8EXPLOITED (CISA KEV)Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i…
• CVE-2024-4990CRITIQUE 9.1In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that th…
• CVE-2024-32877MOYENNE 4.7Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scriptin…
• CVE-2015-5467CRITIQUE 9.8web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter…