CVE-2022-28346

CVE-2022-28346 SQL injection in QuerySet.annotate, aggregate, and extra Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: root@kitploit: python manage.py makemigrations cve202228346 python...

CVE-2021-35042

CVE-2021-35042 SQL injection via unsanitized QuerySet.orderby input Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: root@kitploit: python manage.py makemigrations cve202135042 python...

CVE-2022-28346

CVE-2022-28346 PoC Impact: Potential SQL injection in QuerySet.annotate, aggregate, and extra. Installation root@kitploit: poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC root@kitploit: ?field=poc.title" FR...

CVE-2022-28346

CVE-2022-28346 A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely. Table of Contents CVE-2022-28346 Description Environment Proof of Concept and...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction root@kitploit: 访问http://x.x.x.x:8000/demo POC:...

CVE-2019-14234

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit CVE-2019-14234 Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField. Reference link:...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459-Testbed A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter parameter injection via dictionary expansion using Docker. About the Vulnerability CVE-2025-64459 is a high-severity vulnerability in Django specifically versions 5.1.14 that allows...

CVE-2025-57833

CVE-2025-57833 针对 CVE-2025–57833 的示例易受攻击应用程序 Django 4.2 至 4.2.24 之前版本、5.1 至 5.1.12 之前版本以及 5.2 至 5.2.6 之前版本存在 SQL 注入漏洞， 该漏洞源于将字典展开作为 kwargs 传递给 QuerySet.annotate 或 QuerySet.alias 时引发。 目前仍在开发中。 本内容仅供教育用途。...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2021-35042

CVE-2021-35042: Django SQL注入漏洞 I. 概述 Django 是一个开源的 Web 应用程序框架，使用 Python 编写，基于 MVC（Model - View - Controller）模型构建。它最初是为了管理由 Lawrence 出版集团拥有的新闻内容网站而构建的，是一个 CMS（内容管理系统）软件。 Django 3.1.x - 3.1.13 和 3.2.x - 3.2.5 版本存在 SQL 注入漏洞。 导致此漏洞的原因是 QuerySet.orderby 中对用户可控输入数据的过滤功能不足以防御 SQL...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-016807)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016807 advisory. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods QuerySet.filter, QuerySet.exclude, and QuerySet.get, and the class...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-016788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016788 advisory. An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...