yiiframework vulnerabilities

Products

• yii 17
• yiiframework 4
• gii 2
• yii2-authclient 2
• yii2-redis 1

Latest yiiframework CVEs

Newest publication first · page 1 of 2

1. CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

   Published 2025-06-05

   Medium·CVSS 5.1 EPSS 0.35%

   The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be...

2. CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used

   Published 2025-04-10

   Medium·CVSS 6.1 EPSS 0.25%

   Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

3. CVE-2024-58136 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

   Published 2025-04-10

   Critical·CVSS 9.8 EPSS 87.8% CISA KEV added 2025-05-02 Exploited in the wild

   Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

4. CVE-2025-2690 yiisoft Yii2 MockClass.php generate deserialization

   Published 2025-03-24

   Medium·CVSS 5.3 EPSS 0.68%

   A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The...

5. CVE-2025-2689 yiisoft Yii2 SortableIterator.php getIterator deserialization

   Published 2025-03-24

   Medium·CVSS 5.3 EPSS 0.63%

   A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remot...

6. CVE-2024-4990 Unsafe Reflection in base Component class in yiisoft/yii2

   Published 2025-03-20

   Critical·CVSS 9.1 EPSS 80.1% PoC

   In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the __set() magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters t...

7. CVE-2024-32877 Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

   Published 2024-05-30

   Medium·CVSS 4.7 EPSS 0.35%

   Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the...

8. CVE-2023-50714 The Oauth2 PKCE implementation is vulnerable

   Published 2023-12-22

   High·CVSS 8.8 EPSS 0.49%

   yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (s...

9. CVE-2023-50708 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

   Published 2023-12-22

   Critical·CVSS 9.8 EPSS 0.72%

   yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular strin...

10. CVE-2023-47130 Unsafe deserialization of user data in yiisoft/yii

    Published 2023-11-14

    Critical·CVSS 9.8 EPSS 3.1%

    Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been devel...

11. CVE-2015-5467 Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

    Published 2023-09-21

    Critical·CVSS 9.8 EPSS 0.88% PoC

    web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.

12. CVE-2020-36655 Command injection in yiisoft/yii2-gii

    Published 2023-01-21

    High·CVSS 8.8 EPSS 1.5%

    Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.

13. CVE-2022-34297 Yii2 Gii Cross-site Scripting vulnerability

    Published 2022-12-09

    Medium·CVSS 5.4 EPSS 0.64%

    Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.

14. CVE-2022-41922 yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input

    Published 2022-11-23

    Critical·CVSS 9.8 EPSS 1.2%

    yiisoft/yii before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls unserialize() on arbitrary user input. This has been patched in 1.1.27.

15. CVE-2021-3692 Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    Published 2021-08-10

    Medium·CVSS 5.3 EPSS 1.7%

    yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

16. CVE-2021-3689 Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    Published 2021-08-10

    High·CVSS 7.5 EPSS 1.9%

    yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

17. CVE-2020-15148 Unsafe deserialization in Yii 2

    Published 2020-09-15

    Critical·CVSS 10.0 EPSS 77.5% PoC

    Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

18. CVE-2018-20745 Yii Incorrectly Implements CORS

    Published 2019-01-28

    Medium·CVSS 5.9 EPSS 0.54%

    Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

19. CVE-2018-8074 Yii Framework Code Injection

    Published 2018-03-21

    High·CVSS 8.1 EPSS 1.5% PoC

    Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.

20. CVE-2018-7269 Yii SQL injection vulnerability

    Published 2018-03-21

    Critical·CVSS 9.8 EPSS 1.9% PoC

    The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.

21. CVE-2018-8073 yii2-redis Potential Remote code execution

    Published 2018-03-21

    Critical·CVSS 9.8 EPSS 1.6% PoC

    Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.

22. CVE-2018-6009 Yii Framework Cross-Site Request Forgery (CSRF)

    Published 2018-01-22

    High·CVSS 8.8 EPSS 0.60% PoC

    In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.

23. CVE-2018-6010 Yii Framework reflected Cross-site Scripting

    Published 2018-01-22

    High·CVSS 7.5 EPSS 2.9% PoC

    In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exceptio...

24. CVE-2017-11516 Yii Cross-site Scripting Framework vulnerability

    Published 2017-07-21

    Medium·CVSS 6.1 EPSS 0.83%

    An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.

25. CVE-2015-3397 Yii Framework Cross-site Scripting Vulnerability

    Published 2015-05-14

    Medium·CVSS 4.3 EPSS 2.4% PoC

    Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.