CVE-2026-103475

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

EUVD-2026-90206

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103475

Versions of yii2-starter-kit through 4.2.0 are vulnerable because the default development configuration sets allowedIPs to ['*'], exposing the Yii debug and Gii modules to all IP addresses. Unauthenticated remote attackers can exploit this to access the debug endpoint to read sensitive data, such...

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103475: Active Debug Code

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

PT-2026-103500

Name of the Vulnerable Software and Affected Versions yii2-starter-kit versions prior to 4.2.0 Description The software exposes the Yii debug and Gii modules to all IP addresses by setting the allowedIPs variable to '' in the default development configuration. Unauthenticated remote attackers can...

EUVD-2025-141940

Malicious code in goodafin-nuig-gii npm...

EUVD-2023-46123

Malicious code in bioql PyPI...

EUVD-2023-0322

Malicious code in bioql PyPI...

EUVD-2022-7771

Malicious code in bioql PyPI...

CVE-2022-34297

Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field...

CVE-2020-36655

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file...

CVE-2023-41630

eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the Gii code generator component...

CVE-2023-41630

eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the Gii code generator component...

CVE-2023-41630

eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the Gii code generator component...

Remote code execution

eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the Gii code generator component...

eSST Monitoring Code Injection Vulnerability

Sourceforge eSST Monitoring is an open source monitoring system from Sourceforge. A security vulnerability exists in eSST Monitoring version v2.147.1, which stems from a Remote Code Execution RCE vulnerability in the Gii code generator component...

CVE-2023-41630: Improper Control of Generation of Code

eSST Monitoring v2.147.1 was discovered to contain a remote code execution RCE vulnerability via the Gii code generator component...