Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

CVE-2020-15227

CVE-2020-15227 DISCLAIMER! I take no responsibility of using it in wild life environment so please do NOT do it. This thingy is just to demonstrate and for test things for sysadmins I made this exploit according to publishing a CVE of David Grudl The founder of Nette foundation as he did not solv...

CVE-2020-15227

CVE-2020-15227 DISCLAIMER! I take no responsibility of using it in wild life environment so please do NOT do it. This thingy is just to demonstrate and for test things for sysadmins This tool tests for vulnerability in nette/application. How to fix the vulnerability Composer Update dependency to...

Nette Framework Callback RCE (CVE-2020-15227)

Exploits CVE-2020-15227 in Nette Application before 2.0.19/3.0.6: attacker-controlled callback parameters passed to calluserfunc on /nette.micro/ yield remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework callback injection RCE CVE-2020-15227.""" import re from...

Nette Framework - Remote Code Execution Detection

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework versions before...

CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir..., recursive: true on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name...

PT-2026-38271

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1 Description The make:controller CLI command allows arbitrary directory creation outside the project root. This occurs because the command calls mkdir..., recursive: true on a path constructed from a user-supplie...

EUVD-2024-3464

Malicious code in bioql PyPI...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

GHSA-F626-677R-J5VQ Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

Nette Database security vulnerabilities

Nette Database is a Nette open source database layer with a familiar PDO-like API but more powerful features. A security vulnerability exists in Nette Database 3.2.4 and earlier versions, which stems from the presence of a SQL injection vulnerability that allows an attacker to manipulate the...

CVE-2024-55586: Improper Neutralization of Special Elements used in an SQL Command

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database versions 3.2.4 and earlier are susceptible to SQL injection when an untrusted filter is passed directly to the where method . This vulnerability allows an attacker to manipulate database query logic by constructing malicious SQL statements. Notably, the vendor maintains that this b...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

PT-2024-36561 · Nette · Nette Database

Name of the Vulnerable Software and Affected Versions: Nette Database versions 3.2.4 and earlier Description: The issue allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. This occurs when there's an untrusted filter sent straight ...