Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download CVE-2026-103476 · Other software · yii2-starter-kit · reported by VulnCheckMedium 6.9
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configurationCVE-2026-103475 · Other software · yii2-starter-kit · reported by VulnCheckCritical 9.3
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files.CVE-2026-103474 · Other software · yii2-starter-kit · reported by VulnCheckHigh 8.7
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
- Product
- yii2-starter-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavioCVE-2026-86730 · Other software · craftcms · reported by VulnCheckHigh 8.7
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 20, 2026Yii 2 is a PHP application framework.CVE-2026-39850 · Other software · yiisoft · reported by GitHubHigh 7.4
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled _file_ key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55.
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2.CVE-2026-7600 · Other software · ArtMin96 · reported by VulDBLow 2.1
A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- yii2-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0.CVE-2025-48493 · Other software · yiisoft · reported by GitHubMedium 5.1
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
- Product
- yii2-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39.CVE-2025-2690 · Other software · yiisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45.CVE-2025-2689 · Other software · yiisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a CVE-2024-4990 · Websites & servers · yiisoft · reported by security@huntr.devCritical 9.1
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2024Yii 2 is a PHP application framework.CVE-2024-32877 · Other software · yiisoft · reported by GitHubMedium 4.2
Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an added "...". The full argument value becomes visible when hovering over it with the mouse, as it is displayed in the title attribute of a span tag. However, the use of a double quote (") allows an attacker to break out of the title attribute's value context and inject their own attributes into the span tag, including malicious JavaScript code through event handlers such as onmousemove. This vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are accessible on the page), content substitution, or complete takeove
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50714 · Other software · yiisoft · reported by GitHubMedium 6.8
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50708 · Other software · yiisoft · reported by GitHubMedium 6.1
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.CVE-2015-5467 · Other software · Yiiframework · reported by MITRECritical 9.8
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
- Product
- YII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comyiiframework.com
Jan 20, 2023Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field.CVE-2020-36655 · Other software · Yiiframework · reported by MITREHigh 8.8
Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlab.wallarm.com
Jan 6, 2023A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7.CVE-2014-125051 · Other software · himiklab · reported by VulDBMedium 5.5
A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
- Product
- yii2-jqgrid-widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8.CVE-2017-20158 · Other software · vova07 · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Yii2 FileAPI Widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.CVE-2022-34297 · Other software · Yiiframework · reported by MITREMedium 5.4
Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
- Product
- GII
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 10, 2021yii2 is vulnerable to Use of Predictable Algorithm in Random Number GeneratorCVE-2021-3692 · Websites & servers · yiisoft · reported by security@huntr.devMedium 5.3
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021yii2 is vulnerable to Use of Predictable Algorithm in Random Number GeneratorCVE-2021-3689 · Websites & servers · yiisoft · reported by security@huntr.devHigh 7.5
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2021An issue was found in yii2_fecshop 2.x.CVE-2020-22808 · Other software · Fecmall Project · reported by MITREMedium 6.1
An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
- Product
- Fecmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input.CVE-2020-15148 · Other software · yiisoft · reported by GitHubHigh 8.9
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
- Product
- yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2020yidashi yii2cmf 2.0 has XSS via the /search q parameter.CVE-2018-10704 · Other software · Yii2cmf Project · reported by MITREMedium 6.1
yidashi yii2cmf 2.0 has XSS via the /search q parameter.
- Product
- Yii2cmf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtesth5shanglv.minshengec.comgithub.com
Sep 8, 2019YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.CVE-2019-16130 · Other software · Hgw168cc · reported by MITREMedium 6.1
YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
- Product
- Yii-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cngithub.com
Jun 13, 2018The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.CVE-2018-12290 · Other software · Yii2-statemachine · reported by MITREMedium 6.1
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
- Product
- Yii2-statemachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.