Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

yiisoft/yii2

12 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 critical, 3 high, 1 medium
Registry
Packagist

Advisories 12

  • Yii 2: Local file inclusion via view parameter name collision

    Affected: fixed in 2.0.55.

  • CVE-2024-58136Critical 9.0 · KEV

    Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i

    Affected: fixed in 2.0.52.

  • Unsafe Reflection in base Component class in yiisoft/yii2

    Affected: fixed in 2.0.49.4.

  • CVE-2024-32877Medium 4.2

    Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

    Affected: from 2.0.43, fixed in 2.0.49.4.

  • web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view…

    Affected: from 2.0.0, fixed in 2.0.5.

  • Unsafe deserialization in Yii 2

    Affected: fixed in 2.0.38.

  • Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible…

    Affected: fixed in 2.0.16.

  • In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit…

    Affected: from 2.0.0, fixed in 2.0.14.

  • In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

    Affected: from 2.0, fixed in 2.0.14.

  • An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when…

    Affected: from 2.0.12, fixed in 2.0.13.

  • Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers…

    Affected: fixed in 2.0.11.

  • Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via…

    Affected: fixed in 2.0.4.