[ Vendor · 3 CVEs ]
yii2-starter-kit
CVEs affecting yii2-starter-kit published in the last 30 days, plus any yii2-starter-kit CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103474 | 30 Sep 2026 | CVSS 8.8 | yii2-starter-kityii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP… | |
| CVE-2026-103475 | 30 Sep 2026 | CVSS 9.1 | yii2-starter-kityii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development… | |
| CVE-2026-103476 | 30 Sep 2026 | CVSS 5.3 | yii2-starter-kityii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers… |