CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5467
https://notcve.org/view.php?id=CVE-2015-5467
web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter. web\ViewAction en Yii (también conocido como Yii2) 2.x anterior a 2.0.5 permite a los atacantes ejecutar cualquier archivo .php local a través de una ruta relativa en el parámetro de vista. • https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii2-dev/CVE-2015-5467.yaml https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26750
https://notcve.org/view.php?id=CVE-2023-26750
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework. • https://github.com/yiisoft/yii2/issues/19755 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813 https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3692 – Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
https://notcve.org/view.php?id=CVE-2021-3692
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator yii2 es vulnerable a un Uso de Algoritmo Predecible en el Generador de Números Aleatorios • https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46 https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba • CWE-330: Use of Insufficiently Random Values CWE-1241: Use of Predictable Algorithm in Random Number Generator •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3689 – Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2
https://notcve.org/view.php?id=CVE-2021-3689
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator yii2 es vulnerable al Uso de un Algoritmo Predecible en el Generador de Números Aleatorios • https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46 https://huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f • CWE-330: Use of Insufficiently Random Values CWE-1241: Use of Predictable Algorithm in Random Number Generator •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 1CVE-2020-15148 – Unsafe deserialization in Yii 2
https://notcve.org/view.php?id=CVE-2020-15148
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory. Yii 2 (yiisoft/yii2) versiones anteriores a 2.0.38 es vulnerable a una Ejecución de Código Remota si la aplicación llama a "unserialize()" en una entrada arbitraria de usuario. Esto es corregido en la versión 2.0.38. • https://github.com/Maskhe/CVE-2020-15148-bypasses https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99 https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj • CWE-502: Deserialization of Untrusted Data •