Vulnerabilityhigh
Attackers chained Craft CMS zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-58136 | Regression of Yii 2 Behavior-Attachment Flaw (CVE-2024-4990) Enables In-the-Wild RCE | 9.8 | 88% | KEVPoC | KEV |
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS | 10.0 | 100% | KEVPoC ×4 | KEV |
From the original article
2 min read at securityaffairs.com
Orange Cyberdefense’s CSIRT reported that threat actors exploited two vulnerabilities in Craft CMS to breach servers and steal data. Orange Cyberdefense’s CSIRT warns that threat actors chained two Craft CMS vulnerabilities in recent attacks. Orange experts discovered the flaws while investigating a server compromise.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.