What’s Vulnerable › Vulnerabilities

CVE-2023-26750

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-04 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework.

Affected products

• yiisoft yii: from 2.0.0 through 2.0.47

References

• https://github.com/yiisoft/yii2/issues/19755
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351
• https://github.com/yiisoft/yii2/issues/19755
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1426155955
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505390813
• https://github.com/yiisoft/yii2/issues/19755#issuecomment-1505560351

Get alerted when CVE-2023-26750 or the next vulnerability affects your stack