CVE-2020-15148-bypasses

CVE-2020-15148-bypasses Several bypasses for CVE-2020-15148 Yii2 deserialization poc1 This one is exploitable in version 2.0.37, fixed in 2.0.38, which was assigned CVE-2020-15148. The following three are bypasses. checkAccess = 'system'; $this-id = 'ls'; namespace Faker use yii\rest\CreateAction...

cve-2020-15148

cve-2020-15148 cve-2020-15148...

CVE-2020-15148

creationtimestamp| type| source ---|---|--- 2026-09-22 23:00:22+00:00| seen| Telegram/ig7K5wALKnw7tbTFiMmZIJAWkE7HJFNiMnvDDeQWUrdrGe4 2026-09-22 23:00:22+00:00| published-proof-of-concept| Telegram/ig7K5wALKnw7tbTFiMmZIJAWkE7HJFNiMnvDDeQWUrdrGe4...

CVE-2020-15148

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2020-15148 Unsafe deserialization in Yii 2

Yii 2 yiisoft/yii2 before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory...

CVE-2020-15148

CVE-2020-15148 – Yii 2 (