Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432...

The vulnerability of the PHP framework Yii, related to the lack of protection for website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the PHP framework Yii is related to the lack of protective measures for the structure of web pages. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2025-32027

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

CVE-2025-32027

CVE-2025-32027 affects the Yii PHP framework (yiisoft/yii) prior to 1.1.31. The issue is a Reflected XSS vulnerability that occurs in certain scenarios when the fallback error renderer is used. Impact is limited to scenarios described in the advisory; no exploitation details are provided in the s...

CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...

Improper Protection of Alternate Path

Overview yiisoft/yii2 is a Yii PHP Framework. Affected versions of this package are vulnerable to Improper Protection of Alternate Path when defining a class array key in the set function of Component.php. An attacker can achieve code execution by manipulating the input to the behavior attachment...

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025...

GHSA-GGWG-CMWP-46R5 yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025...

Yii 安全漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii versions prior to 1.1.31, which stems from reflective cross-site scripting...

VulnCheck KEV: CVE-2024-58136

Yii Framework contains an improper protection of alternate path vulnerability that may allow a remote attacker to execute arbitrary code. This vulnerability could affect other products that implement Yii, including—but not limited to—Craft CMS, as represented by CVE-2025-32432...

Yii2 代码问题漏洞

Yii2 is a fast, secure and professional PHP framework from Yii Open Source. A code issue vulnerability exists in Yii2 2.0.45 and earlier versions, which stems from a deserialization issue and could lead to remote attacks...

Yii2 代码问题漏洞

Yii2 is a fast, secure and professional PHP framework from Yii Open Source. A code issue vulnerability exists in Yii2 2.0.39 and earlier versions, which stems from a deserialization issue and could lead to remote attacks...

Building Your First Web Application with Yii Framework

Did you know that over 80% of web applications fail due to poor planning and execution? Now imagine…...

PT-2025-15893

Name of the Vulnerable Software and Affected Versions Yii 2 versions prior to 2.0.52 Description The issue arises from the mishandling of behavior attachment, specifically when behaviors are defined by a class array key. This has been exploited in the wild, with approximately 13,000 vulnerable...

The vulnerability of the Debug Mode mode in the PHP framework Yii allows attackers to perform cross-site scripting attacks.

The vulnerability of the Debug Mode mode in the Yii PHP framework lies in the lack of protection for the structure of web pages, due to incorrect handling of function arguments during stack tracing. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks remotely...

CVE-2024-32877

Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. This issue lies in the mechanism for...

Yii Security Vulnerabilities

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A security vulnerability exists in Yii 2 version 2.0.49.3 that originates from a specially crafted link that allows an attacker to execute arbitrary JavaScript code in t...

funboot 跨站脚本漏洞

Funboot is a Yii2 based Saas rapid development platform by individual developer peanut funson86. A cross-site scripting vulnerability exists in funboot v1.1, which stems from an easy cross-site scripting attack via the title field in create a message...