CVE-2023-47130

Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-502

• https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06Patch
• https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8qPatch
• https://owasp.org/www-community/vulnerabilities/PHP_Object_InjectionThird Party Advisory
• https://github.com/yiisoft/yii/commit/37142be4dc5831114a375392e86d6450d4951c06Patch
• https://github.com/yiisoft/yii/security/advisories/GHSA-mw2w-2hj2-fg8qPatch
• https://owasp.org/www-community/vulnerabilities/PHP_Object_InjectionThird Party Advisory

Published

Nov 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47125TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2023-47126TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2023-47127TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2023-47128Piccolo is an object-relational mapping and query builder wh…9.1
• CVE-2023-47129Statmic is a core Laravel content management system Composer…9.8
• CVE-2023-4713A vulnerability has been found in IBOS OA 4.5.5 and classifi…8.8
• CVE-2023-47131The N-able PassPortal extension before 3.29.2 for Chrome ins…7.5
• CVE-2023-47132An issue discovered in N-able N-central before 2023.6 and ea…9.8
• CVE-2023-4714A vulnerability was found in PlayTube 3.0.1 and classified a…7.5
• CVE-2023-47140IBM CICS Transaction Gateway 9.3 could allow a user to trans…8.1
• CVE-2023-47141IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect S…6.5
• CVE-2023-47142IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 …8.8