Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Apr 9, 2025Yiiframework Yii Improper Protection of Alternate Path VulnerabilityCVE-2024-58136 · Other software · Yiiframework · reported by MITREExploitedCritical 9
Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432.
- Product
- Yii
- On CISA’s list since
- May 2, 2025 (federal fix deadline May 23, 2025)
- What to do
- Attackers are using this now. Install Yiiframework’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Sep 21, 2023web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.CVE-2015-5467 · Other software · Yiiframework · reported by MITRECritical 9.8
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comyiiframework.com
Jul 27, 2023Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books.CVE-2022-31454 · Other software · Yiiframework · reported by MITREMedium 6.1
Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction funcCVE-2023-26750 · Other software · Yiiframework · reported by MITRECritical 9.8
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field.CVE-2020-36655 · Other software · Yiiframework · reported by MITREHigh 8.8
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlab.wallarm.com
Dec 9, 2022Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.CVE-2022-34297 · Other software · Yiiframework · reported by MITREMedium 5.4
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 28, 2019Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS securityCVE-2018-20745 · Other software · Yiiframework · reported by MITREMedium 5.9
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2018Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the ElasticseCVE-2018-8074 · Other software · Yiiframework · reported by MITREHigh 8.1
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Mar 21, 2018Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.CVE-2018-8073 · Other software · Yiiframework · reported by MITRECritical 9.8
Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Mar 21, 2018The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() CVE-2018-7269 · Other software · Yiiframework · reported by MITRECritical 9.8
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Jan 22, 2018In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the errCVE-2018-6010 · Other software · Yiiframework · reported by MITREHigh 7.5
In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2018In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.CVE-2018-6009 · Other software · Yiiframework · reported by MITREHigh 8.8
In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, becCVE-2017-11516 · Other software · Yiiframework · reported by MITREMedium 6.1
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2015Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSOCVE-2015-3397 · Other software · Yiiframework · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comyiiframework.com
Jul 3, 2014The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.CVE-2014-4672 · Other software · Yiiframework · reported by MITREHigh 7.5
The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
- Product
- Yiiframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyiiframework.comyiiframework.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.