Unscored severity · published Jul 3, 2014
CVE-2014-4672
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property
–
CVSS
2.1%
EPSS
No
On KEV
Description
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YI
Yiiframework · Yiiframework
1.1.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4672
Vendor Advisory
http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/
More from Yiiframework
8.8
CVE-2018-6009
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity
7.5
CVE-2018-6010
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in…
–
CVE-2015-3397
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and…