Every CVE Search/ Get API key

CVE-2020-15227

Remote Code Execution vulnerability

8.7 HighPublic exploitFix available

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

34.4%Up 29.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.7

Remote Code Execution vulnerability

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Record
CVE-2020-15227
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2020-1420 8.7

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Record
EUVD-2020-1420
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8gv3-3j7f-wg94 8.7

Potential Remote Code Execution vulnerability

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE.

Reported by Cyku Hong from DEVCORE (https://devco.re)

Impact

Code injection, possible remote code execution.

Patches

Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13

Record
GHSA-8gv3-3j7f-wg94
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-74, CWE-94
Updated
2026-11-02
NVD 8.7

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Record
CVE-2020-15227
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74, CWE-94
Updated
2026-11-02
OSV 9.8

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Record
CVE-2020-15227
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-8gv3-3j7f-wg94 8.7

Potential Remote Code Execution vulnerability

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE.

Reported by Cyku Hong from DEVCORE (https://devco.re)

Impact

Code injection, possible remote code execution.

Patches

Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13

Record
GHSA-8gv3-3j7f-wg94
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-74, CWE-94
Updated
2026-11-02
OSVUBUNTU-CVE-2020-15227 9.8

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

Record
UBUNTU-CVE-2020-15227
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUSN-5983-1 No score

php-nette vulnerability

Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A remote attacker could possibly use this issue to execute arbitrary code.

Record
USN-5983-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nette/application
Packagist
 2.2.0 up to 2.2.10
2.2.10
nette/application
Packagist
 2.3.0 up to 2.3.14
2.3.14
nette/application
Packagist
 2.4.0 up to 2.4.16
2.4.16
nette/application
Packagist
 3.0.0 up to 3.0.6
3.0.6
nette/application
Packagist
 2.0.0 up to 2.0.19
2.0.19
nette/application
Packagist
 2.1.0 up to 2.1.13
2.1.13
php-nette
Debian:9
 before 2.4-20160731-1+deb9u1, plus listed versions
2.4-20160731-1
2.4-20160731-1+deb9u1
nette/application
Packagist
 2.2.0 up to 2.2.10, plus listed versions
v2.2.0v2.2.1v2.2.2v2.2.3v2.2.4
Show 5 moreShow less
v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9
2.2.10
nette/application
Packagist
 2.3.0 up to 2.3.14, plus listed versions
v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12
Show 9 moreShow less
v2.3.13v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9
2.3.14
nette/application
Packagist
 2.4.0 up to 2.4.16, plus listed versions
v2.4.0v2.4.1v2.4.10v2.4.11v2.4.12
Show 11 moreShow less
v2.4.13v2.4.14v2.4.15v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9
2.4.16
nette/application
Packagist
 3.0.0 up to 3.0.6, plus listed versions
v3.0.0v3.0.1v3.0.2v3.0.2.1v3.0.3v3.0.4v3.0.5
3.0.6
php-nette
Ubuntu:Pro:16.04:LTS
 before 2.3.8-1ubuntu1+esm1, plus listed versions
2.3.4-12.3.5-12.3.7-12.3.8-12.3.8-1ubuntu1
2.3.8-1ubuntu1+esm1
php-nette
Ubuntu:18.04:LTS
 before 2.4-20160731-1ubuntu0.1, plus listed versions
2.4-20160731-1
2.4-20160731-1ubuntu0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiNette Framework - Remote Code Execution
PoC in GitHubLangriklol/CVE-2020-152272020-10-09
PoC in GitHubfilipsedivy/CVE-2020-152272020-11-15
PoC in GitHubhu4wufu/CVE-2020-152272020-10-10

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15227 is a high vulnerability (CVSS 8.7) in Debian Linux, published October 1, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.4%, the 98th percentile. Fixed in nette/application 2.2.10.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open