{"id":"CVE-2018-6010","aliases":["GHSA-8gfq-c54m-3rf6"],"url":"https://o3.security/vulnerability/CVE-2018-6010","summary":"Yii Framework reflected Cross-site Scripting","details":"In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.","published":"2018-01-22T22:29:00.270Z","modified":"2026-10-24T10:47:33.223406092Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.02859,"percentile":0.8568,"asOf":"2026-08-22"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"yiisoft/yii2","fixedVersion":"2.0.14"}],"fix":{"url":"https://github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b4369050582fcf5c7a","label":"yiisoft/yii2@6b0be47"},"references":[{"type":"REPORT","url":"https://github.com/yiisoft/yii2/issues/14711"},{"type":"REPORT","url":"https://github.com/yiisoft/yii2/pull/15534"},{"type":"FIX","url":"https://github.com/yiisoft/yii2/commit/6b0be47e0fa9c532e03b07b4369050582fcf5c7a"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6010"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2/CVE-2018-6010.yaml"},{"type":"PACKAGE","url":"https://github.com/yiisoft/yii2-framework"},{"type":"WEB","url":"https://www.yiiframework.com/news/165/yii-2-0-14-is-released"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:47:33.223406092Z"}}