Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-4990 | Unsafe Reflection in Yii2 Component __set() Enables RCE and Info Disclosure | 9.1 | 80% | PoC | |
| CVE-2024-58136 | Regression of Yii 2 Behavior-Attachment Flaw (CVE-2024-4990) Enables In-the-Wild RCE | 9.8 | 88% | KEVPoC | KEV |
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS | 10.0 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-42599 | Unauthenticated RCE via Stack-Based Buffer Overflow in Qualitia Active! mail 6 | 9.8 | 3% | KEV | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Apr 28, 2025 Web Application Security / Vulnerability Threat actors have been observed exploiting two newly disclosed critical security flaws in Craft CMS in zero-day attacks to breach servers and gain unauthorized access. The attacks, first observed by Orange Cyberdefense SensePost on February 14, 2025, involve chaining the below vulnerabilities -
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.