Critical severity9.8NVD Advisory· Published Dec 10, 2024· Updated Apr 15, 2026

CVE-2024-55586

Description

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nette/databasePackagist	<= 3.2.4	—

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-f626-677r-j5vqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-55586ghsaADVISORY
github.com/github/advisory-database/pull/5079ghsaWEB
www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.htmlnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000