Skip to content
OpenAdvisories

Package · Packagist

yiisoft/yii

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2023-47130

    Unsafe deserialization of user data in yiisoft/yii

    Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host syste…

    yiisoft yii yiisoft/yii Packagist
  • High 8.1
    CVE-2022-41922

    yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input

    `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

    yiisoft yii yiisoft/yii Packagist
  • High —
    CVE-2014-4672

    Yii PHP Framework arbitrary PHP scripts execution

    The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

    yiisoft/yii Packagist