Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

yiisoft/yii2-dev

7 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 1 medium
Registry
Packagist

Advisories 7

  • CVE-2025-2689Medium 5.3

    yiisoft Yii2 SortableIterator.php getIterator deserialization

    Affected: through 2.0.45.

  • Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    Affected: fixed in 2.0.43.

  • Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    Affected: fixed in 2.0.43.

  • Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in…

    Affected: from 2.0.0, fixed in 2.0.15.

  • The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection…

    Affected: fixed in 2.0.12.1; from 2.0.13, fixed in 2.0.13.2; from 2.0.14, fixed in 2.0.15.

  • In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

    Affected: from 2.0, fixed in 2.0.14.

  • An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when…

    Affected: from 2.0.12, fixed in 2.0.13.