Skip to content
OpenAdvisories

Package · Packagist

yiisoft/yii2

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.2
    CVE-2024-32877

    Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

    Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). Th…

    yiisoft yii2 yiisoft/yii2 Packagist
  • Medium 5.9
    CVE-2018-20745

    Yii Incorrectly Implements CORS

    Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

    yiisoft/yii2 Packagist
  • Medium 6.1
    CVE-2017-11516

    Yii Cross-site Scripting Framework vulnerability

    An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

    yiisoft/yii2 yiisoft/yii2-dev Packagist
  • Medium 6.1
    CVE-2017-7271

    Yii Framework Reflected XSS

    Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.

    yiisoft/yii2 Packagist
  • Medium —
    CVE-2015-3397

    Yii Framework Cross-site Scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

    yiisoft/yii2 Packagist