CVE-2018-7269

2018-03-2118:29:00

Google

osv.dev

8.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.4%

JSON

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.

CPENameOperatorVersion
yii2eq2.0.0
yii2eq2.0.11.1
yii2eq2.0.8
yii2eq2.0.14
yii2eq2.0.13.1
yii2eq2.0.6
yii2eq2.0.5
yii2eq2.0.14.2
yii2eq2.0.11.2
yii2eq2.0.2