yiisoft/yii2 vulnerabilities
Yii PHP Framework Version 2
- Registry
- Composer
- Latest
- 2.0.55
- License
- BSD-3-Clause
12 known advisories
The latest version, 2.0.55, is not affected by any of them. Projects on older versions may be.
composer require yiisoft/yii2:^2.0.55Security advisories for yiisoft/yii2
Yii 2: Local file inclusion via view parameter name collision
- Affected
- <2.0.55
- Fixed in
- 2.0.55
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
- Affected
- <2.0.52
- Fixed in
- 2.0.52
Unsafe Reflection in base Component class in yiisoft/yii2
- Affected
- <2.0.49.4
- Fixed in
- 2.0.49.4
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
- Affected
- >=2.0.43 <2.0.49.4
- Fixed in
- 2.0.49.4
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
- Affected
- >=2.0.0 <2.0.5
- Fixed in
- 2.0.5
Yii Framework Cross-site Scripting Vulnerability
- Affected
- <2.0.4
- Fixed in
- 2.0.4
Yii Framework Reflected XSS
- Affected
- <2.0.11
- Fixed in
- 2.0.11
Yii Cross-site Scripting Framework vulnerability
- Affected
- >=2.0.12 <2.0.13
- Fixed in
- 2.0.13
Yii Framework Cross-Site Request Forgery (CSRF)
- Affected
- >=2.0 <2.0.14
- Fixed in
- 2.0.14
Yii Incorrectly Implements CORS
- Affected
- <2.0.16
- Fixed in
- 2.0.16
Yii Framework reflected Cross-site Scripting
- Affected
- >=2.0.0 <2.0.14
- Fixed in
- 2.0.14
Unsafe deserialization in Yii 2
- Affected
- <2.0.38
- Fixed in
- 2.0.38
Which of your client projects still run an old yiisoft/yii2?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.