yiisoft/yii2

HIGH7.4 11 May 2026

Yii 2: Local file inclusion via view parameter name collision

GHSA-5vpg-rj7q-qpw2 · CVE-2026-39850

Affected

< 2.0.55

Fixed in

2.0.55

Published

11 May 2026

CRITICAL9.0 10 Apr 2025

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

GHSA-ggwg-cmwp-46r5 · CVE-2024-58136

Affected

< 2.0.52

Fixed in

2.0.52

Published

10 Apr 2025

HIGH8.1 4 Jun 2024

Unsafe Reflection in base Component class

GHSA-cjcc-p67m-7qxm · CVE-2024-4990

Affected

< 2.0.49.4

Fixed in

2.0.49.4

Published

4 Jun 2024

MODERATE4.2 2 Jun 2024

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

GHSA-qg5r-95m4-mjgj · CVE-2024-32877

Affected

≥ 2.0.43, < 2.0.49.4

Fixed in

2.0.49.4

Published

2 Jun 2024

MODERATE6.1 17 May 2022

Yii Framework Reflected XSS

GHSA-4xh9-5vh8-3p58 · CVE-2017-7271

Affected

< 2.0.11

Fixed in

2.0.11

Published

17 May 2022

MODERATE6.1 17 May 2022

Yii Cross-site Scripting Framework vulnerability

GHSA-4c64-w8fg-xcq2 · CVE-2017-11516

Affected

2.0.12

Fixed in

no fix yet

Published

17 May 2022

MODERATE5.9 14 May 2022

Yii Incorrectly Implements CORS

GHSA-cr6r-6xm9-ww22 · CVE-2018-20745

Affected

< 2.0.16

Fixed in

2.0.16

Published

14 May 2022

HIGH10.0 14 Sep 2020

Possible remote code execution via unserialize() on user input containing specially crafted string

PKSA-qmd6-d7pz-yk89 · CVE-2020-15148

Affected

< 2.0.38

Fixed in

2.0.38

Published

14 Sep 2020

UNRATED9.8 20 Mar 2018

Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`

PKSA-hb8b-2qmh-yv87 · CVE-2018-7269

Affected

< 2.0.12.1 ≥ 2.0.13, < 2.0.13.2 ≥ 2.0.14, < 2.0.15

Fixed in

2.0.12.1 2.0.13.2 2.0.15

Published

20 Mar 2018

HIGH7.5 22 Jan 2018

Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

PKSA-rkx4-rmt9-k26g · CVE-2018-6010

Affected

< 2.0.14

Fixed in

2.0.14

Published

22 Jan 2018

HIGH8.8 13 Jan 2018

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

PKSA-tgtc-bnhk-szjb · CVE-2018-6009

Affected

< 2.0.14

Fixed in

2.0.14

Published

13 Jan 2018

CRITICAL 10 Jul 2015

class yii\web\ViewAction allowed to include arbitrary files that end with .php

PKSA-62sq-zmbb-yyr8 · CVE-2015-5467

Affected

< 2.0.5

Fixed in

2.0.5

Published

10 Jul 2015

MODERATE 10 May 2015

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

PKSA-98w7-zrnb-gcw4 · CVE-2015-3397

Affected

< 2.0.4

Fixed in

2.0.4

Published

10 May 2015