yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.52<2.0.52Fixed versions: 2.0.52
Vulnerability intelligence Composer
yiisoft/yii2
Yii PHP Framework Version 2
Composer latest 2.0.55 BSD-3-Clause
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
2.0.55
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
13 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-7cfq-72w2-24q4 critical
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.0.5<2.0.5Fixed versions: 2.0.5
GHSA-5vpg-rj7q-qpw2 high
Yii 2: Local file inclusion via view parameter name collision
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.55<2.0.55Fixed versions: 2.0.55
GHSA-699q-wcff-g9mj high
Unsafe deserialization in Yii 2
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.38<2.0.38Fixed versions: 2.0.38
GHSA-cjcc-p67m-7qxm high
Unsafe Reflection in base Component class in yiisoft/yii2
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.49.4<2.0.49.4Fixed versions: 2.0.49.4
GHSA-8gfq-c54m-3rf6 high
Yii Framework reflected Cross-site Scripting
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.0.14<2.0.14Fixed versions: 2.0.14
GHSA-cwhm-272p-3wj9 high
Yii Framework Cross-Site Request Forgery (CSRF)
Affected range
ECOSYSTEM: introduced 2.0; fixed 2.0.14<2.0.14Fixed versions: 2.0.14
GHSA-qg5r-95m4-mjgj moderate
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
Affected range
ECOSYSTEM: introduced 2.0.43; fixed 2.0.49.4>=2.0.43,<2.0.49.4Fixed versions: 2.0.49.4
GHSA-w2xx-jp9f-gp8g moderate
Yii Framework Cross-site Scripting Vulnerability
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.4<2.0.4Fixed versions: 2.0.4
GHSA-4c64-w8fg-xcq2 moderate
Yii Cross-site Scripting Framework vulnerability
Affected range
ECOSYSTEM: introduced 2.0.12; fixed 2.0.13=2.0.12Fixed versions: 2.0.13
GHSA-4xh9-5vh8-3p58 moderate
Yii Framework Reflected XSS
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.11<2.0.11Fixed versions: 2.0.11
GHSA-cr6r-6xm9-ww22 moderate
Yii Incorrectly Implements CORS
Affected range
ECOSYSTEM: introduced 0; fixed 2.0.16<2.0.16Fixed versions: 2.0.16
PKSA-hb8b-2qmh-yv87 unknown
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
Affected range
<2.0.12.1|>=2.0.13,<2.0.13.2|>=2.0.14,<2.0.15