CVE-2018-7269: Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`

Severity: Critical

CVSS Score: 9.8

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.