Vulnerabilities > Yiiframework > Yiiframework > 2.0.3

DATE CVE VULNERABILITY TITLE RISK
2018-01-22 CVE-2018-6010 Cross-site Scripting vulnerability in Yiiframework
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode.
network
low complexity
yiiframework CWE-79
5.0
5.0
2018-01-22 CVE-2018-6009 Cross-Site Request Forgery (CSRF) vulnerability in Yiiframework
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity. 		6.8
6.8
2015-05-14 CVE-2015-3397 Cross-site Scripting vulnerability in Yiiframework
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7. 		4.3
4.3