Nette framework PHP code injection via callback
Description
Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an PHP code injection attack by passing specially formed parameters to URL that may possibly leading to remote code execution (RCE).
Remediation
Upgrade to the latest version of nette/application and/or nette/nette.