Yiiframework vulnerabilities

Products

• Yii 19
• Yiiframework 4
• Gii 2
• Yii2-authclient 2

Newest

• yiiframework yii2-redis Yii 2 Redis may expose AUTH paramters in logs in case of connection failure CVE-2025-48493 Fix available 5.1 MediumJune 5, 2025
• yiiframework yii Yii does not prevent XSS in scenarios where fallback error renderer is used CVE-2025-32027 Fix available 6.1 MediumApril 10, 2025
• yiiframework yii yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136 In KEVFix available EPSS 87.8% 9.0 CriticalApril 10, 2025
• yiiframework yii, yiisoft yii2 +1 more yiisoft Yii2 MockClass.php generate deserialization CVE-2025-2690 5.3 MediumMarch 24, 2025
• yiiframework yii, yiisoft yii2 +1 more yiisoft Yii2 SortableIterator.php getIterator deserialization CVE-2025-2689 5.3 MediumMarch 24, 2025
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Unsafe Reflection in base Component class in yiisoft/yii2 CVE-2024-4990 Fix available EPSS 80.1% 8.1 HighJune 2, 2024
• yiiframework yii, yiisoft yii2 +1 more Reflected Cross-site Scripting in yiisoft/yii2 Debug mode CVE-2024-32877 Fix available 4.2 MediumMay 30, 2024
• yiiframework yii2-authclient yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation CVE-2023-50708 Fix available 6.1 MediumDecember 18, 2023
• yiiframework yii2-authclient The Oauth2 PKCE implementation is vulnerable CVE-2023-50714 Fix available 6.8 MediumDecember 18, 2023
• yiiframework yii Unsafe deserialization of user data in yiisoft/yii CVE-2023-47130 Fix available 8.1 HighNovember 14, 2023
• yiiframework yii Yii2 allows attackers to execute any local .php file via a relative path in the view parameter CVE-2015-5467 Fix available 9.8 CriticalSeptember 21, 2023
• yiiframework yii Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the... CVE-2022-31454 Disputed 6.1 MediumJuly 28, 2023
• yiiframework yii Withdrawn: SQL injection in Yii 2 CVE-2023-26750 Disputed 9.8 CriticalApril 4, 2023
• yiiframework gii Command injection in yiisoft/yii2-gii CVE-2020-36655 Fix available 8.8 HighJanuary 21, 2023
• yiiframework gii Yii2 Gii Cross-site Scripting vulnerability CVE-2022-34297 5.4 MediumDecember 9, 2022
• yiiframework yii yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input CVE-2022-41922 Fix available 8.1 HighNovember 21, 2022
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 CVE-2021-3692 Fix available 8.1 HighAugust 10, 2021
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 CVE-2021-3689 Fix available 8.1 HighAugust 10, 2021
• yiiframework yii, yiisoft yii2 +1 more Unsafe deserialization in Yii 2 CVE-2020-15148 Public exploitFix available EPSS 77.5% 8.9 HighSeptember 15, 2020
• yiiframework yii Yii Incorrectly Implements CORS CVE-2018-20745 Fix available 5.9 MediumJanuary 28, 2019
• yiiframework yii Yii Framework Code Injection CVE-2018-8074 Fix available 8.1 HighMarch 21, 2018
• yiiframework yii yii2-redis Potential Remote code execution CVE-2018-8073 Fix available 9.8 CriticalMarch 21, 2018
• yiiframework yii Yii SQL injection vulnerability CVE-2018-7269 Fix available 9.8 CriticalMarch 21, 2018
• yiiframework Yii Framework reflected Cross-site Scripting CVE-2018-6010 Fix available 7.5 HighJanuary 22, 2018
• yiiframework Yii Framework Cross-Site Request Forgery (CSRF) CVE-2018-6009 Fix available 8.8 HighJanuary 22, 2018
• yiiframework yii Yii Cross-site Scripting Framework vulnerability CVE-2017-11516 Fix available 6.1 MediumJuly 21, 2017
• yiiframework Yii Framework Cross-site Scripting Vulnerability CVE-2015-3397 Fix available 4.3 MediumMay 14, 2015
• yiiframework Yii PHP Framework arbitrary PHP scripts execution CVE-2014-4672 Fix available 7.5 HighJuly 3, 2014