by Kastro
Paper/Archive/CVE-2025-2690

CVE-2025-2690

yiisoft Yii2 — yiisoft Yii2 MockClass.php generate deserialization

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
Yii22.0.0–CNA
Yii22.0.1–CNA
Yii22.0.2–CNA
Yii22.0.3–CNA
Yii22.0.4–CNA
Yii22.0.5–CNA
Yii22.0.6–CNA
Yii22.0.7–CNA
Yii22.0.8–CNA
Yii22.0.9–CNA
Yii22.0.10–CNA
Yii22.0.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.300711refvuldb.com/?ctiid.300711writeupvuldb.com/?submit.521718exploitgithub.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md