CVE-2024-36039

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 21, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-36048.8The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode CVE-2024-360417.8KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on CVE-2024-360429.8Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticCVE-2024-360436.1question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.CVE-2024-360469.8Infoblox NIOS through 8.6.4 executes with more privileges than required.CVE-2024-360479.8Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.CVE-2024-360489.8QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.CVE-2024-360496.5Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pasCVE-2024-36059.8The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms RECVE-2024-360504.3Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attackerCVE-2024-360527.5RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-202CVE-2024-360539.0In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in chec
CVE-2024-36039: Medium severity, CVSS 6.3 | Vulnix