6.1
CVE-2025-32027
- EPSS 0.2%
- Veröffentlicht 10.04.2025 14:32:31
- Zuletzt bearbeitet 17.09.2025 18:30:17
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginYii does not prevent XSS in scenarios where fallback error renderer is used
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Yiiframework ≫ Yii Version < 1.1.31
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.2% | 0.101 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5
https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368