Vendor

    Yiiframework

    28 known vulnerabilities in products by Yiiframework, 1 of them actively exploited (CISA KEV).

    Key figures

    28

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Yiiframework
    CriticalCVE-2024-58136

    Yiiframework Yii Improper Protection of Alternate Path Vulnerability

    In CISA KEV

    		9.0
    CriticalCVE-2024-4990

    Unsafe Reflection in base Component class in yiisoft/yii2

    also in 1 other product

    		8.1
    CriticalCVE-2020-15148

    Unsafe deserialization in Yii 2

    also in 1 other product

    		8.9
    CriticalCVE-2023-47130

    Unsafe deserialization of user data in yiisoft/yii

    also in 1 other product

    		8.1
    CriticalCVE-2023-26750

    Yii: SQL Injection

    		9.8
    CriticalCVE-2018-7269

    Yii: SQL Injection

    		9.8
    HighCVE-2018-6010

    Yii Framework: Cross-Site Scripting (XSS)

    		7.5
    CriticalCVE-2018-8073

    Yii: security vulnerability

    		9.8
    HighCVE-2021-3689

    Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    also in 1 other product

    		8.1
    HighCVE-2020-36655

    Yiiframework Gii: Code Execution

    		8.8
    HighCVE-2021-3692

    Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2

    also in 1 other product

    		8.1
    HighCVE-2018-8074

    Yii: security vulnerability

    		8.1
    CriticalCVE-2022-41922

    Yii: Deserialization of Untrusted Data

    also in 1 other product

    		8.1
    CriticalCVE-2015-5467

    Yii: security vulnerability

    		9.8
    HighCVE-2018-6009

    Yii Framework: Cross-Site Request Forgery (CSRF)

    		8.8
    CriticalCVE-2025-2690

    yiisoft Yii2 MockClass.php generate deserialization

    also in 1 other product

    		6.3
    CriticalCVE-2025-2689

    yiisoft Yii2 SortableIterator.php getIterator deserialization

    also in 1 other product

    		6.3
    CriticalCVE-2023-50708

    Yiisoft Yii2-authclient: Observable Discrepancy

    also in 1 other product

    		6.1
    MediumCVE-2017-11516

    Yii: Cross-Site Scripting (XSS)

    		6.1
    Not ratedCVE-2015-3397

    Yii Framework: Cross-Site Scripting (XSS)

    		—
    Not ratedCVE-2014-4672

    Yii Framework: security vulnerability

    		—
    HighCVE-2023-50714

    The Oauth2 PKCE implementation is vulnerable

    also in 1 other product

    		6.8
    MediumCVE-2022-34297

    Yiiframework Gii: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2025-48493

    Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

    also in 1 other product

    		6.5
    MediumCVE-2018-20745

    Yii: security vulnerability

    		5.9

    All vulnerabilities in search

    Products

    Products by Yiiframework
    Yii191
    Yii Framework40