Skip to content
OpenAdvisories

Product · djangoproject

Django

50 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-4277

    Privilege abuse in GenericInlineModelAdmin

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI