What’s Vulnerable › Products

yiisoft yii vulnerabilities

20 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your yiisoft yii version is affected

Exploited yiisoft yii vulnerabilities

• CVE-2024-58136 — Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Latest yiisoft yii vulnerabilities

• CVE-2026-39850 — Yii 2: Local file inclusion via view parameter name collision (CVSS 7.4)
• CVE-2025-32027 — Yii does not prevent XSS in scenarios where fallback error renderer is used (CVSS 6.1)
• CVE-2024-58136 — Yiiframework Yii Improper Protection of Alternate Path Vulnerability (CVSS 9.8) — exploited
• CVE-2025-2690 — yiisoft Yii2 MockClass.php generate deserialization (CVSS 9.8)
• CVE-2025-2689 — yiisoft Yii2 SortableIterator.php getIterator deserialization (CVSS 9.8)
• CVE-2024-4990 — Unsafe Reflection in base Component class in yiisoft/yii2 (CVSS 9.1)
• CVE-2024-32877 — Reflected Cross-site Scripting in yiisoft/yii2 Debug mode (CVSS 4.7)
• CVE-2023-47130 — Unsafe deserialization of user data in yiisoft/yii (CVSS 9.8)
• CVE-2015-5467 — (CVSS 9.8)
• CVE-2022-31454 — (CVSS 6.1)
• CVE-2023-26750 — (CVSS 9.8)
• CVE-2022-41922 — yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input (CVSS 9.8)
• CVE-2021-3692 — Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (CVSS 5.3)
• CVE-2021-3689 — Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (CVSS 7.5)
• CVE-2020-15148 — Unsafe deserialization in Yii 2 (CVSS 10.0)
• CVE-2018-20745 — (CVSS 5.9)
• CVE-2018-8074 — (CVSS 8.1)
• CVE-2018-8073 — (CVSS 9.8)
• CVE-2018-7269 — (CVSS 9.8)
• CVE-2017-11516 — (CVSS 6.1)