Skip to content
OpenAdvisories

Vendor

yiisoft

14 known vulnerabilities.

Products

yii2 5 yii 3 yiisoft/yii2 3 yii2-authclient 2 yii2-redis 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.9
    CVE-2020-15148 Public exploit EPSS 78%

    Unsafe deserialization in Yii 2

    Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

    yiisoft yii2 yiisoft/yii2 Packagist