Skip to content
Yiisoft Yii vulnerabilities
-
yiisoft yii2
Yii 2: Local file inclusion via view parameter name collision
CVE-2026-39850
Fix available
7.4 High
-
yiiframework yii2-redis
Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
CVE-2025-48493
Fix available
5.1 Medium
-
yiiframework yii
Yii does not prevent XSS in scenarios where fallback error renderer is used
CVE-2025-32027
Fix available
6.1 Medium
-
yiiframework yii, yiisoft yii2 +1 more
yiisoft Yii2 MockClass.php generate deserialization
CVE-2025-2690
5.3 Medium
-
yiiframework yii, yiisoft yii2 +1 more
yiisoft Yii2 SortableIterator.php getIterator deserialization
CVE-2025-2689
5.3 Medium
-
yiiframework yii, yiisoft yiisoft/yii2 +1 more
Unsafe Reflection in base Component class in yiisoft/yii2
CVE-2024-4990
Fix available
EPSS 80.1%
8.1 High
-
yiiframework yii, yiisoft yii2 +1 more
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
CVE-2024-32877
Fix available
4.2 Medium
-
yiiframework yii2-authclient
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
CVE-2023-50708
Fix available
6.1 Medium
-
yiiframework yii2-authclient
The Oauth2 PKCE implementation is vulnerable
CVE-2023-50714
Fix available
6.8 Medium
-
yiiframework yii
Unsafe deserialization of user data in yiisoft/yii
CVE-2023-47130
Fix available
8.1 High
-
yiiframework yii
yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input
CVE-2022-41922
Fix available
8.1 High
-
yiiframework yii, yiisoft yiisoft/yii2 +1 more
Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
CVE-2021-3692
Fix available
8.1 High
-
yiiframework yii, yiisoft yiisoft/yii2 +1 more
Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
CVE-2021-3689
Fix available
8.1 High
-
yiiframework yii, yiisoft yii2 +1 more
Unsafe deserialization in Yii 2
CVE-2020-15148
Public exploitFix available
EPSS 77.5%
8.9 High