{
  "@id": "urn:uuid:8812f9c1-e6e5-488e-baee-9c93b437d444",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-7269 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7269"
      },
      "impact_statement": "CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it."
    }
  ]
}