Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

The version of Yii Framework installed on the remote host is prior to 2.0.52. It is, therefore, affected by an unsafe reflection vulnerability.

  - Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a   CVE-2024-4990 regression, as exploited in the wild in February through April 2025. (CVE-2024-58136)  

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CraftCMS version 3.x prior to 3.9.15 or 4.x prior to 4.14.15 or 5.x prior to 5.6.16 is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

ID	Name	Product	Family	Severity
261483	Yii Framework < 2.0.52 Unsafe Reflection Regression (GHSA-ggwg-cmwp-46r5)	Nessus	Misc.	critical
114786	CraftCMS 3.x < 3.9.15 / 4.x < 4.14.15 / 5.x < 5.6.17 Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-58136

critical

Tenable Plugins

critical

critical