CVE-2024-24811

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
zopefoundationProducts.SQLAlchemyDA< 2.2

References

Timeline

Published
Feb 7, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-248125.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side librarCVE-2024-248137.5Frappe is a full-stack web application framework. Prior to versions 14.64.0 and 15.0.0, SQL injection from a particular whitelisted method cCVE-2024-248147.5mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID CCVE-2024-248156.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HCVE-2024-248166.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discoveredCVE-2024-248175.3Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform DiscourCVE-2024-248185.9EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" pageCVE-2024-248198.8icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` isCVE-2024-24823.7A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerabilitCVE-2024-248208.3Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to maCVE-2024-248217.8Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included duCVE-2024-248229.1Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. ta