CVE-2022-1544: Improper neutralization of formula elements in yii-helpers

high Affects luyadev/yii-helpers. Feed 2026.10.29.1, updated 2026-10-28; published 2022-05-03; advisory modified 2023-11-08.

Improper neutralization of formula elements in yii-helpers

Package: luyadev/yii-helpers Composer
Affected versions: <1.2.1
Fixed in: 1.2.1
Severity: high CVSS 7.8
Exploitation: not on CISA KEV · EPSS 2% (83.8th percentile)
Published: 2022-05-03
Source: osv.dev

References

CWE-1236

NVD record luyadev/yii-helpers advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2020-9372 high The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in same weakness: CWE-1236
CVE-2020-11548 critical The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the s same weakness: CWE-1236
CVE-2019-15092 high The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for Wor same weakness: CWE-1236
CVE-2018-11525 high The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vu same weakness: CWE-1236
CVE-2018-11526 high The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulne same weakness: CWE-1236
CVE-2018-10504 high The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection. same weakness: CWE-1236