yiisoft/yii2 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-39850Highyiisoft/yii2: Yii 2: Local file inclusion via view parameter name collision CVE-2024-58136Criticalyiisoft/yii2: yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-4990Highyiisoft/yii2: Unsafe Reflection in base Component class in yiisoft/yii2 CVE-2024-32877Mediumyiisoft/yii2: Reflected Cross-site Scripting in yiisoft/yii2 Debug mode CVE-2015-5467Criticalyiisoft/yii2: Yii2 allows attackers to execute any local .php file via a relative path in the view parameter CVE-2015-3397Mediumyiisoft/yii2: Yii Framework Cross-site Scripting Vulnerability CVE-2017-7271Mediumyiisoft/yii2: Yii Framework Reflected XSS CVE-2017-11516Mediumyiisoft/yii2-dev: Yii Cross-site Scripting Framework vulnerability CVE-2018-6009Highyiisoft/yii2: Yii Framework Cross-Site Request Forgery (CSRF)CVE-2018-20745Mediumyiisoft/yii2: Yii Incorrectly Implements CORS CVE-2018-6010Highyiisoft/yii2: Yii Framework reflected Cross-site Scripting CVE-2020-15148Highyiisoft/yii2: Unsafe deserialization in Yii 2

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo