Skip to content
OpenAdvisories

Vendor

yii2-starter-kit

3 known vulnerabilities.

Products

yii2-starter-kit 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-103476

    yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download

    yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve fi…

    yii2-starter-kit yii2-starter-kit