CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL 삽입 환경 초기화 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 취약점 재현 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demouser" union SELECT "1",sqliteversion,"3"...

CVE-2022-28346

CVE-2022-28346 PoC 영향: QuerySet.annotate, aggregate 및 extra에서 잠재적 SQL 인젝션. 설치 poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT "-1,",sqliteversion,"3" -- 참고 자료 C...

CVE-2022-28346

CVE-2022-28346 QuerySet.annotate, aggregate, extra의 SQL 인젝션 설정: 초기 설정을 위해 ./setup.sh를 실행합니다 데이터베이스를 초기화하려면 Docker 이미지를 엽니다: docker exec -it containerid /bin/bash 그리고 다음 명령을 실행합니다: python manage.py makemigrations cve202228346 python manage.py migrate 다음 명령으로 인스턴스를 시작합니다: docker-compose up 이제 샘플 데이...

Django-faille-CVE-2025-57833_test

Django의 별칭을 통한 SQL 인젝션 취약점 테스트 정의: 별칭이란? 별칭 은 SQL 쿼리에서 열이나 집계 결과에 부여된 이름입니다. Django에서 별칭은 annotate 또는 alias 메서드와 함께 사용되어 계산된 필드에 이름을 지정합니다. 예시: from django.db.models import Count books = Book.objects.annotatebookcount=Count'id' 여기서 bookcount는 Count'id' 결과의 별칭 입니다. 계산된 열에 대해 읽기 쉬운 이름을 검색할 수 있습니다. ...

CVE-2025-57833

CVE-2025-57833 CVE-2025–57833에 대한 예시 취약 애플리케이션 Django 4.2 4.2.24 이전 버전, 5.1 5.1.12 이전 버전, 5.2 5.2.6 이전 버전은 Dictionary 확장을 통해 kwargs가 QuerySet.annotate 또는 QuerySet.alias에 전달될 때 SQL 인젝션에 취약합니다. 현재 작업 진행 중입니다. 교육 목적으로만 제공됩니다...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

CVE-2026-82834: Improper Access Control

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099460 advisory. An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitab...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

Use After Free

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Django: Django: SQL Injection via crafted column aliases

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-006300)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006300 advisory. An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a...

Django: Django: SQL Injection via crafted column aliases

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

SQL Injection

Django is vulnerable to SQL injection. The vulnerability is due to improper handling of column aliases in FilteredRelation when using dictionary expansion kwargs, where crafted keys containing control characters can manipulate SQL generation in methods such as annotate, aggregate, extra, values,...

Juniper Junos OS Vulnerability (JSA100096)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100096 advisory. - An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high...

CVE-2026-1287

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

CVE-2026-1287

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet methods annotate, aggregat...

CVE-2026-1287: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet methods annotate, aggregat...

SQL Injection

Django is vulnerable to SQL Injection. The vulnerability is due to improper handling of column aliases in FilteredRelation when expanding user-controlled dictionaries passed to QuerySet.annotate or QuerySet.alias, which allows an attacker to inject crafted SQL on PostgreSQL...

BIT-DJANGO-2025-13372 Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet.annotate or QuerySet.alias on PostgreSQL. Earlier...