Search for packages
| purl | pkg:composer/yiisoft/yii2-dev@2.0.38 |
| Next non-vulnerable version | 3.0.0-alpha1 |
| Latest non-vulnerable version | 3.0.0-alpha1 |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6rub-m94d-jfct
Aliases: CVE-2021-3689 GHSA-hq3v-rg6f-6hx4 |
Use of Insufficiently Random Values yii2 is vulnerable to use of predictable algorithm in a random number generator |
Affected by 2 other vulnerabilities. |
|
VCID-gb9u-t143-vker
Aliases: CVE-2021-3692 GHSA-wwvv-x5mq-h3jj |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator |
Affected by 2 other vulnerabilities. |
|
VCID-x388-wd41-tkh3
Aliases: CVE-2025-2689 GHSA-88m2-j94x-v4fx |
yiisoft Yii2 Deserialization of Untrusted Data A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
Affected by 1 other vulnerability. |
|
VCID-xrgb-33bd-ckat
Aliases: CVE-2023-26750 GHSA-gq63-p39p-jrjf |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-gwmb-kcz9-d7b9 | Deserialization of Untrusted Data Yii 2 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. |
CVE-2020-15148
GHSA-699q-wcff-g9mj |