yiisoft/yii · Security
Yii PHP Framework arbitrary PHP scripts execution
- GHSA ID
- GHSA-74qv-rv53-5wcx
- CVE ID
- CVE-2014-4672
- Severity
- high
- Published
- Updated
Description
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')