CVE-2024-44902
Critical · CVSS 9.8ThinkPHP (topthink/framework) — PHP deserialization RCE (CWE-502)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-502, CWE-502
Description
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Search profile — drives PoC discovery
Symbols topthink/frameworkunserializeThinkPHP__wakeup__destructPOP chainPackagist
Keywords CVE-2024-44902ThinkPHP deserialization RCEtopthink framework unserializeThinkPHP 6.1.3 8.0.4 RCEThinkPHP POP chain exploitfru1ts CVE-2024-44902
Versions: v6.1.3 to v8.0.4
Ranked PoCs (20) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 0
- ★ 0
- ★ 0
- ★ 6
- ★ 0
- ★ 012442RF/POC needs reviewtrickest
- ★ 0DMW11525708/wiki needs reviewtrickest
- ★ 0Lern0n/Lernon-POC needs reviewtrickest
- ★ 0Linxloop/fork_POC needs reviewtrickest
- ★ 0PumpkinBridge/ThinkPHPv6.1.3-v8.0.4-POC needs reviewtrickest
- ★ 0cisp-pte/POC-20241008-sec-fork needs reviewtrickest
- ★ 0cyb3r-w0lf/nuclei-template-collection needs reviewtrickest
- ★ 0eeeeeeeeee-code/POC needs reviewtrickest
- ★ 0fkie-cad/nvd-json-data-feeds needs reviewtrickest
- ★ 0greenberglinken/2023hvv_1 needs reviewtrickest
- ★ 0iemotion/POC needs reviewtrickest
- ★ 0laoa1573/wy876 needs reviewtrickest
- ★ 0oLy0/Vulnerability needs reviewtrickest
- ★ 0plbplbp/loudong001 needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
Affected packages
| Packagist | topthink/framework | 6.1.3 → ∞ |
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z