yiisoft/yii

yiisoft/yii

www.yiiframework.com

Releases54

Frequency3 months 1 day

Last Release7 months ago

Stars4.83K

Yii PHP Framework 1.1.x

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-32027NVD↗	< 1.1.31	Apr 10, 2025Thursday, 10 April 2025, 15:16	6.1 MEDIUM	—
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.
CVE-2023-47130NVD↗	< 1.1.29	Nov 14, 2023Tuesday, 14 November 2023, 21:15	8.1 HIGH	—
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2022-41922NVD↗	< 1.1.27	Nov 23, 2022Wednesday, 23 November 2022, 18:15	8.1 HIGH	—
`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.
CVE-2017-7271NVD↗	<= 2.0.10	Mar 27, 2017Monday, 27 March 2017, 17:59	—	4.3 MEDIUM
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.