CVE-2022-41922

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-419239.8Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. CVE-2022-419249.6A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, whic CVE-2022-419258.8A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tails CVE-2022-419265.5Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protecte CVE-2022-419277.4XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any conf CVE-2022-419288.8XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xm CVE-2022-419294.9org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user CVE-2022-41938.8Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system r CVE-2022-419308.2org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with acce CVE-2022-419318.8xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user wit CVE-2022-419325.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create CVE-2022-419336.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten passwor