CVE-2020-15227

CVE-2020-15227 免责声明！我不对在真实环境中使用它承担任何责任，所以请勿这样做。这个工具仅用于演示和为系统管理员提供测试 此工具用于检测 nette/application 中的漏洞。 如何修复漏洞 Composer 将依赖更新到最新版本。 nette/application =3.0.6 nette/application =2.4.16 nette/application =2.3.14 nette/application =2.2.10 nette/nette = 2.1.13 nette/nette = 2.0.19 将新依赖...

CVE-2020-15227

CVE-2020-15227 免责声明！我不对在真实环境中使用此工具负责，所以请勿这样做。这个东西仅用于演示和供系统管理员测试。 我根据大卫·格鲁德尔（Nette 基金会创始人）发布的 CVE 漏洞编写了此利用代码， 因为他没有尽快解决问题，也没有向安全人员提供文档（利用方式） 以检查可能的入侵情况，反而将其隐藏起来。好吧，那就这样吧。 作为一名安全研究员，我开发了一个小怪物（当然仅用于教育和演示目的） 该安全漏洞利用了 nette.micro 中的 callback 参数。我们完全不明白为什么会存在这个垃圾（可能是后门功能？） 此利用代码试图从受害者服务器获取反弹 Shell。URL...

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir..., recursive: true on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name...

PT-2026-38271

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1 Description The make:controller CLI command allows arbitrary directory creation outside the project root. This occurs because the command calls mkdir..., recursive: true on a path constructed from a user-supplie...

EUVD-2024-3464

Malicious code in bioql PyPI...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

GHSA-F626-677R-J5VQ Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

Withdrawn Advisory: Nette Database SQL injection

Withdrawn Advisory This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references. Original Description Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

Nette Database 安全漏洞

Nette Database is a Nette open source database layer with a familiar PDO-like API but more powerful features. A security vulnerability exists in Nette Database 3.2.4 and earlier versions, which stems from the presence of a SQL injection vulnerability that allows an attacker to manipulate the...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

CVE-2024-55586 (Nette Database) : Affected software is Nette Database up to version 3.2.4. The vulnerability is a SQL injection vulnerability where an untrusted filter is passed directly to the where method, enabling manipulation of query logic. The vendor states this is intended behavior. Public...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

CVE-2024-55586

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior...

PT-2024-36561 · Nette · Nette Database

Name of the Vulnerable Software and Affected Versions: Nette Database versions 3.2.4 and earlier Description: The issue allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. This occurs when there's an untrusted filter sent straight ...

nette-schuhe.de Improper Access Control vulnerability OBB-3776919

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ubuntu: Security Advisory (USN-5983-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5983-1: Nette vulnerability

Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A remote attacker could possibly use this issue to execute arbitrary code...

USN-5983-1 php-nette vulnerability

Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A remote attacker could possibly use this issue to execute arbitrary code...