CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31454
https://notcve.org/view.php?id=CVE-2022-31454
Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2. Se ha descubierto que Yii 2 v2.0.45 contiene una vulnerabilidad Cross-Site Scripting (XSS) a través del endpoint "/books". • https://medium.com/%40rohitgautam26/cve-2022-31454-8e8555c31fd3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26750
https://notcve.org/view.php?id=CVE-2023-26750
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework. • https://github.com/yiisoft/yii2/issues/19755 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •