CVE-2024-55586

9.8 criticalEPSS 0.6%

Critical (9.8). EPSS 0.6% chance of exploitation in the next 30 days.

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/CSIRTTrizna/CVE-2024-55586
https://github.com/nette/database/releases
https://www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.html

Check your stack JSON