Yiiframework

Records29All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Yiiframework records in CISA KEV

TI-2024-38344 Yiiframework Yii Improper Protection of Alternate Path Vulnerability CRITICAL 100KEV 2025-05-02

Components

Products in the NVD configurations · select one to filter the records

Yii 19 records CRITICAL Yiiframework 4 records LOW Gii 2 records HIGH Yii2-authclient 2 records MEDIUM Yii2-redis 1 record LOW

Records

4 records in Yiiframework · all components

TI-2018-04377 CVE-2018-6009 · GHSA-cwhm-272p-3wj9

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not…

LOW 39

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00597 Published 2018-01-22 Fixed in 2.0.14 CWE-352

TI-2018-04378 CVE-2018-6010 · GHSA-8gfq-c54m-3rf6

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive…

LOW 38

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02883 Published 2018-01-22 Fixed in 2.0.14 CWE-79

TI-2014-03851 CVE-2014-4672 · GHSA-74qv-rv53-5wcx

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute…

LOW 37

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02122 Published 2014-07-03 Fixed in 1.1.15 CWE-94

TI-2015-03005 CVE-2015-3397 · GHSA-w2xx-jp9f-gp8g

Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote…

LOW 25

Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02381 Published 2015-05-14 Fixed in 2.0.4 CWE-79

Open these records in search →

Critical	10
High	8
Medium	11
Low	0
No CVSS	0