Approved changes feed: RSS · Atom
cpe:2.3:a:yiisoft:yii:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Yiisoft (a0ea30c8-3362-539e-80d4-0397100931f5) |
|---|---|
| Product | Yii (71234620-a817-5847-a933-a1c22e2ebc1f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-32027 |
vulnerable | 2026-06-08 07:18:58.971172 |
Yii does not prevent XSS in scenarios where fallback error renderer is used
MEDIUM (6.1)
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
Published: 2025-04-10T14:32:31.116Z
Updated: 2025-04-10T14:54:23.272Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47130 |
vulnerable | 2026-06-08 06:14:24.034965 |
Unsafe deserialization of user data in yiisoft/yii
HIGH (8.1)
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2023-11-14T20:30:16.393Z
Updated: 2024-08-14T19:26:42.011Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41922 |
vulnerable | 2026-06-08 05:49:28.887673 |
yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input
HIGH (8.1)
`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.
Published: 2022-11-23T00:00:00.000Z
Updated: 2025-04-23T16:35:42.955Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.