Lucene search

K

[email protected]NVD:CVE-2024-36039

HistoryMay 21, 2024 - 4:15 p.m.

CVE-2024-36039

2024-05-2116:15:26

[email protected]

web.nvd.nist.gov

pymysql

sql injection

untrusted json input

escape_dict

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

References

github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1

lists.debian.org/debian-lts-announce/2024/05/msg00017.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK/

7.3 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

Related for NVD:CVE-2024-36039

nessus6 vulnrichment1 redhatcve1 debian2 openvas4 osv5 fedora2 github1 veracode1 cvelist1 ubuntu1 redos1 wolfi1 debiancve1 ubuntucve1 cve1