Yiisoft Yii vulnerabilities

CVE-2023-47130 [CRITICAL] CWE-502 CVE-2023-47130: Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are

CVE-2022-41922 [CRITICAL] CWE-502 CVE-2022-41922: `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

CVE-2014-4672 [HIGH] CWE-94 Yii PHP Framework arbitrary PHP scripts execution Yii PHP Framework arbitrary PHP scripts execution The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.

CVE-2025-32027 [MEDIUM] CWE-79 CVE-2025-32027: Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.