Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
50 results
Oct 19, 2026Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying CVE-2026-112774 · Other software · craftcms · reported by VulnCheckHigh 8.7
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download CVE-2026-103476 · Other software · yii2-starter-kit · reported by VulnCheckMedium 6.9
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configurationCVE-2026-103475 · Other software · yii2-starter-kit · reported by VulnCheckCritical 9.3
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files.CVE-2026-103474 · Other software · yii2-starter-kit · reported by VulnCheckHigh 8.7
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavioCVE-2026-86730 · Other software · craftcms · reported by VulnCheckHigh 8.7
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previouslCVE-2026-79988 · Other software · craftcms · reported by 7004884b-51e2-48e8-b4a2-5ca29e80453eHigh 8.7
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Yii 2 is a PHP application framework.CVE-2026-39850 · Other software · yiisoft · reported by GitHubHigh 7.4
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2.CVE-2026-7600 · Other software · ArtMin96 · reported by VulDBLow 2.1
A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- yii2-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0.CVE-2025-48493 · Other software · yiisoft · reported by GitHubMedium 5.1
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
- Product
- yii2-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0.CVE-2025-4006 · Other software · youyiio · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- BeyongCms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789.CVE-2025-29660 · Other software · Yiiot · reported by MITRECritical 9.8
A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques.
- Product
- Xy-3820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.CVE-2025-29659 · Other software · Yiiot · reported by MITRECritical 9.8
Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.
- Product
- Xy-3820 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025Yii is an open source PHP web framework.CVE-2025-32027 · Other software · yiisoft · reported by GitHubMedium 6.1
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
- Product
- yii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025Yiiframework Yii Improper Protection of Alternate Path VulnerabilityCVE-2024-58136 · Other software · Yiiframework · reported by MITREExploitedCritical 9
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
- Product
- Yii
- On CISA’s list since
- May 2, 2025 (federal fix deadline May 23, 2025)
- What to do
- Attackers are using this now. Install Yiiframework’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Mar 24, 2025A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39.CVE-2025-2690 · Other software · yiisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45.CVE-2025-2689 · Other software · yiisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a CVE-2024-4990 · Websites & servers · yiisoft · reported by security@huntr.devCritical 9.1
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Yii 2 is a PHP application framework.CVE-2024-32877 · Other software · yiisoft · reported by GitHubMedium 4.2
Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an added "...". The full argument value becomes visible when hovering over it with the mouse, as it is displayed in the title attribute of a span tag. However, the use of a double quote (") allows an attacker to break out of the title attribute's value context and inject their own attributes into the span tag, including malicious JavaScript code through event handlers such as onmousemove. This vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are accessible on the page), content substitution, or complete takeove
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50714 · Other software · yiisoft · reported by GitHubMedium 6.8
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50708 · Other software · yiisoft · reported by GitHubMedium 6.1
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Yii is an open source PHP web framework.CVE-2023-47130 · Other software · yiisoft · reported by GitHubHigh 8.1
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- yii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.CVE-2015-5467 · Other software · Yiiframework · reported by MITRECritical 9.8
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comyiiframework.com
Jul 27, 2023Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books.CVE-2022-31454 · Other software · Yiiframework · reported by MITREMedium 6.1
Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.CVE-2020-21246 · Other software · Yiicms Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.
- Product
- Yiicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction funcCVE-2023-26750 · Other software · Yiiframework · reported by MITRECritical 9.8
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field.CVE-2020-36655 · Other software · Yiiframework · reported by MITREHigh 8.8
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlab.wallarm.com
Jan 6, 2023A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7.CVE-2014-125051 · Other software · himiklab · reported by VulDBMedium 5.5
A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
- Product
- yii2-jqgrid-widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8.CVE-2017-20158 · Other software · vova07 · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Yii2 FileAPI Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.CVE-2022-34297 · Other software · Yiiframework · reported by MITREMedium 5.4
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input.CVE-2022-41922 · Other software · yiisoft · reported by GitHubHigh 8.1
`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.
- Product
- yii
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022A vulnerability, which was classified as critical, has been found in easyii CMS.CVE-2022-3771 · Other software · easyii · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2022A vulnerability was found in easyii CMS.CVE-2020-36534 · Other software · easyii · reported by VulDBMedium 4.3
A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2022Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1.CVE-2022-1544 · Other software · luyadev · reported by security@huntr.devHigh 7.8
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
- Product
- luyadev/yii-helpers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021yii2 is vulnerable to Use of Predictable Algorithm in Random Number GeneratorCVE-2021-3692 · Websites & servers · yiisoft · reported by security@huntr.devMedium 5.3
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021yii2 is vulnerable to Use of Predictable Algorithm in Random Number GeneratorCVE-2021-3689 · Websites & servers · yiisoft · reported by security@huntr.devHigh 7.5
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2021An issue was found in yii2_fecshop 2.x.CVE-2020-22808 · Other software · Fecmall Project · reported by MITREMedium 6.1
An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
- Product
- Fecmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input.CVE-2020-15148 · Other software · yiisoft · reported by GitHubHigh 8.9
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2020yidashi yii2cmf 2.0 has XSS via the /search q parameter.CVE-2018-10704 · Other software · Yii2cmf Project · reported by MITREMedium 6.1
yidashi yii2cmf 2.0 has XSS via the /search q parameter.
- Product
- Yii2cmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtesth5shanglv.minshengec.comgithub.com
Sep 8, 2019YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.CVE-2019-16130 · Other software · Hgw168cc · reported by MITREMedium 6.1
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
- Product
- Yii-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cngithub.com
Jan 28, 2019Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS securityCVE-2018-20745 · Other software · Yiiframework · reported by MITREMedium 5.9
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.CVE-2018-12290 · Other software · Yii2-statemachine · reported by MITREMedium 6.1
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
- Product
- Yii2-statemachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Mar 21, 2018Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the ElasticseCVE-2018-8074 · Other software · Yiiframework · reported by MITREHigh 8.1
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Mar 21, 2018Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.CVE-2018-8073 · Other software · Yiiframework · reported by MITRECritical 9.8
Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Mar 21, 2018The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() CVE-2018-7269 · Other software · Yiiframework · reported by MITRECritical 9.8
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Jan 22, 2018In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the errCVE-2018-6010 · Other software · Yiiframework · reported by MITREHigh 7.5
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2018In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.CVE-2018-6009 · Other software · Yiiframework · reported by MITREHigh 8.8
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, becCVE-2017-11516 · Other software · Yiiframework · reported by MITREMedium 6.1
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2017Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary weCVE-2017-7271 · Other software · YII Software · reported by MITREMedium 6.1
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comyiiframework.com
May 13, 2015Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSOCVE-2015-3397 · Other software · Yiiframework · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comyiiframework.com
Jul 3, 2014The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.CVE-2014-4672 · Other software · Yiiframework · reported by MITREHigh 7.5
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.