Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

yiisoft/yii

4 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 1 medium
Registry
Packagist

Advisories 4

  • CVE-2025-32027Medium 6.1

    Yii does not prevent XSS in scenarios where fallback error renderer is used

    Affected: fixed in 1.1.31.

  • Unsafe deserialization of user data in yiisoft/yii

    Affected: fixed in 1.1.29.

  • yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input

    Affected: fixed in 1.1.27.

  • The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the…

    Affected: from 1.1.14, fixed in 1.1.15.