Skip to content
OpenAdvisories

Package · Debian

python-django

164 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2022-34265 Public exploit EPSS 74%

    Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind cho…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-7471 Public exploit EPSS 66%

    SQL injection in Django

    Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2019-19844 Public exploit EPSS 54%

    Django Potential account hijack via password reset form

    Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2019-14234 Public exploit EPSS 48%

    SQL Injection in Django

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2014-0472 Public exploit

    Code Injection in Django

    The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…

    python-django django python-django Debian Ubuntu PyPI