Skip to contentYiiframework Yii vulnerabilities
- yiiframework yii2-redisYii 2 Redis may expose AUTH paramters in logs in case of connection failureCVE-2025-48493Fix available5.1 Medium
- yiiframework yiiYii does not prevent XSS in scenarios where fallback error renderer is usedCVE-2025-32027Fix available6.1 Medium
- yiiframework yiiyiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array KeyCVE-2024-58136In KEVFix availableEPSS 87.8%9.0 Critical
- yiiframework yii, yiisoft yii2 +1 moreyiisoft Yii2 MockClass.php generate deserializationCVE-2025-26905.3 Medium
- yiiframework yii, yiisoft yii2 +1 moreyiisoft Yii2 SortableIterator.php getIterator deserializationCVE-2025-26895.3 Medium
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUnsafe Reflection in base Component class in yiisoft/yii2CVE-2024-4990Fix availableEPSS 80.1%8.1 High
- yiiframework yii, yiisoft yii2 +1 moreReflected Cross-site Scripting in yiisoft/yii2 Debug modeCVE-2024-32877Fix available4.2 Medium
- yiiframework yii2-authclientyii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementationCVE-2023-50708Fix available6.1 Medium
- yiiframework yii2-authclientThe Oauth2 PKCE implementation is vulnerableCVE-2023-50714Fix available6.8 Medium
- yiiframework yiiUnsafe deserialization of user data in yiisoft/yiiCVE-2023-47130Fix available8.1 High
- yiiframework yiiYii2 allows attackers to execute any local .php file via a relative path in the view parameterCVE-2015-5467Fix available9.8 Critical
- yiiframework yiiYii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the...CVE-2022-31454Disputed6.1 Medium
- yiiframework yiiWithdrawn: SQL injection in Yii 2CVE-2023-26750Disputed9.8 Critical
- yiiframework yiiyiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user inputCVE-2022-41922Fix available8.1 High
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUse of Predictable Algorithm in Random Number Generator in yiisoft/yii2CVE-2021-3692Fix available8.1 High
- yiiframework yii, yiisoft yiisoft/yii2 +1 moreUse of Predictable Algorithm in Random Number Generator in yiisoft/yii2CVE-2021-3689Fix available8.1 High
- yiiframework yii, yiisoft yii2 +1 moreUnsafe deserialization in Yii 2CVE-2020-15148Public exploitFix availableEPSS 77.5%8.9 High
- yiiframework yiiYii Incorrectly Implements CORSCVE-2018-20745Fix available5.9 Medium
- yiiframework yiiYii Framework Code InjectionCVE-2018-8074Fix available8.1 High
- yiiframework yiiyii2-redis Potential Remote code executionCVE-2018-8073Fix available9.8 Critical
- yiiframework yiiYii SQL injection vulnerabilityCVE-2018-7269Fix available9.8 Critical
- yiiframeworkYii Framework reflected Cross-site ScriptingCVE-2018-6010Fix available7.5 High
- yiiframeworkYii Framework Cross-Site Request Forgery (CSRF)CVE-2018-6009Fix available8.8 High
- yiiframework yiiYii Cross-site Scripting Framework vulnerabilityCVE-2017-11516Fix available6.1 Medium
- yiiframeworkYii Framework Cross-site Scripting VulnerabilityCVE-2015-3397Fix available4.3 Medium
- yiiframeworkYii PHP Framework arbitrary PHP scripts executionCVE-2014-4672Fix available7.5 High