CVE-2026-1312

CVE-2026-1312 affects Django: 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The issue is a SQL injection in QuerySet.order_by() when using column aliases that contain periods in a FilteredRelation, where the same alias is passed via a crafted dictionary using dictionary expansion. T...

CVE-2026-1312

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier,...

PT-2026-6375

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.order by is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier,...

Linux Distros Unpatched Vulnerability : CVE-2026-1312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containin...

GHSA-XPFP-F569-Q3P2 SQL Injection in Django

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

The vulnerability of the QuerySet.order_by() function in the Django web application framework allows a hacker to execute arbitrary commands.

The vulnerability of the QuerySet.orderby function in the Django web application framework relates to the lack of security measures for handling SQL queries. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...