EUVD-2022-0088

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

SQL injection found in Django QuerySet.explain() until specified versions due to crafted dictionary input.

Reporter	Title	Published	Views	Family All 136
FreeBSD	Django -- multiple vulnerabilities	2 Apr 202200:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 3.2.13-alt1	12 Apr 202200:00	–	altlinux
AlpineLinux	CVE-2022-28347	12 Apr 202200:00	–	alpinelinux
ArchLinux	[ASA-202204-9] python-django: sql injection	12 Apr 202200:00	–	archlinux
Circl	CVE-2022-28347	12 Apr 202212:23	–	circl
CNNVD	Django SQL注入漏洞	11 Apr 202200:00	–	cnnvd
CNVD	Django SQL Injection Vulnerability (CNVD-2022-31837)	22 Apr 202200:00	–	cnvd
CVE	CVE-2022-28347	12 Apr 202200:00	–	cve
Cvelist	CVE-2022-28347	12 Apr 202200:00	–	cvelist
Debian	[SECURITY] [DSA 5254-1] python-django security update	15 Oct 202216:00	–	debian

[
  {
    "enisaIdVendor": [
      {
        "id": "f17ca79c-aebe-3dd6-a5d0-d5efb99e8035",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "27e67cab-55e6-3e35-a87e-066d1ef3f3d7",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/04/11/1
docs	www.docs.djangoproject.com/en/4.0/releases/security/
djangoproject	www.djangoproject.com/weblog/2022/apr/11/security-releases/
groups	www.groups.google.com/forum/
github	www.github.com/advisories/GHSA-w24h-v9qh-8gxj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-28347
github	www.github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
github	www.github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
github	www.github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
github	www.github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d

03 Oct 2025 20:07Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

CVSS 27.5

EPSS0.00748