CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FRO...

CVE-2021-35042

CVE-2021-35042 SQL injection via unsanitized QuerySet.orderby input Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: python manage.py makemigrations cve202135042 python manage.py migrate...

CVE-2022-28346

CVE-2022-28346 PoC Impact: Potential SQL injection in QuerySet.annotate, aggregate, and extra. Installation poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT...

CVE-2022-28346

CVE-2022-28346 A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely. Table of Contents CVE-2022-28346 Description Environment Proof of Concept and...

CVE-2022-28346

CVE-2022-28346 SQL injection in QuerySet.annotate, aggregate, and extra Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: python manage.py makemigrations cve202228346 python manage.py migra...

CVE-2019-14234

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit CVE-2019-14234 Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField. Reference link:...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

CVE-2025-57833

CVE-2025-57833 Example Vulnerable application for CVE-2025–57833 Django 4.2 before 4.2.24 Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6 is vulnerable to a SQL injection via Dictionary expansion as kwargs is passed to QuerySet.annotate or QuerySet.alias Currently a work in...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459-Testbed A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter parameter injection via dictionary expansion using Docker. About the Vulnerability CVE-2025-64459 is a high-severity vulnerability in Django specifically versions 5.1.14 that allows...

EUVD-2026-93396

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

PT-2026-106735

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description An issue exists in the save existing objects function within django.forms.models.BaseModelFormSet. The function incorrectly uses the...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595: Not Failing Securely

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

PT-2026-93823

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description Isolation in djust.tenants was only enforced on the HTTP path. The current tenant was stored in threading.local and set exclusively by the TenantMiddleware, which is HTTP-only. Consequently, on the liv...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...