EUVD-2022-3649

Malicious code in bioql PyPI...

EUVD-2022-4155

Malicious code in bioql PyPI...

EUVD-2022-2353

Malicious code in bioql PyPI...

EUVD-2025-10695

Malicious code in bioql PyPI...

EUVD-2022-3177

Malicious code in bioql PyPI...

EUVD-2023-1313

Malicious code in bioql PyPI...

EUVD-2022-5469

Malicious code in bioql PyPI...

EUVD-2025-17007

Malicious code in bioql PyPI...

Yii Framework Installed (Linux / Unix)

Binary data yiiframeworknixinstalled.nbin...

CVE-2025-48493

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

CVE-2025-48493: Insertion of Sensitive Information into Log File

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

The vulnerability of the `getIterator` function in the symfony\finder\Iterator\SortableIterator.php file of the PHP framework Yii allows a attacker to execute arbitrary code.

The vulnerability of the getIterator function in the symfony\finder\Iterator\SortableIterator.php file of the PHP framework Yii is related to deserialization mechanism vulnerabilities. Exploiting this vulnerability could allow an attacker to execute arbitrary code by injecting specially crafted...

The vulnerability of the Yii2::createObject() method in the Yii PHP framework allows a attacker to execute arbitrary code.

The vulnerability of the Yii2::createObject method in the Yii PHP framework is related to improper protection of the alternative path. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-32877

Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. This issue lies in the mechanism for...

CVE-2023-26750

SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function. NOTE: the software maintainer's position is that the vulnerability is in third-party code, not in the framework...

CVE-2023-47130

Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...

CVE-2018-20745

Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...