CVE-2017-7271

MEDIUM

Yii Framework <2.0.11 - XSS

Title source: llm

Description

Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.

References (4)

Scores

CVSS v3 6.1
EPSS 0.0029
EPSS Percentile 51.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-79
Status published

Affected Products (3)

yii_software/yii < 2.0.10
yiisoft/yii2 < 2.0.11Packagist
n/a/n/a

Timeline

Published Mar 27, 2017
Tracked Since Feb 18, 2026