Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: yii2-starter-kit Clear all filters
TI-2026-65704 CVE-2026-103475 · GHSA-92vv-q57x-j4vj

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

Priority MEDIUM 48

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00397 Published 2026-09-30 No fix listed CWE-489
TI-2026-65703 CVE-2026-103474 · GHSA-hfh8-jhpw-h99w

yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE

Priority MEDIUM 40

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00388 Published 2026-09-30 No fix listed CWE-434