CVE-2024-58136
CRITICAL KEV NUCLEIYii 2 <2.0.52 - RCE
Title source: llmDescription
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.
Nuclei Templates (1)
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
CRITICALVERIFIEDby ritikchaddha
Shodan:
title:"Yii"
FOFA:
title="Yii"
Scores
CVSS v3
9.0
EPSS
0.5753
EPSS Percentile
98.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CISA KEV
2025-05-02
VulnCheck KEV
2025-04-09
ENISA EUVD
EUVD-2025-10502
CWE
CWE-424
Status
published
Products (2)
yiiframework/yii
< 2.0.52
yiisoft/yii2
0 - 2.0.52Packagist
Published
Apr 10, 2025
KEV Added
May 02, 2025
Tracked Since
Feb 18, 2026