12 matches found
CVE-2021-35042
CVE-2021-35042: vulnerabilidad de inyección SQL en Django I. Resumen Django es un framework de aplicaciones web de código abierto, escrito en Python, construido según el modelo MVC Modelo - Vista - Controlador. Originalmente fue construido para gestionar sitios web de contenido de noticias...
CVE-2021-35042
CVE-2021-35042 SQL injection via QuerySet.orderby untrusted input Setup: Start the instances using: docker-compose up Now open the following URL to load sample data: http://localhost:8000/vulapp/setup Then go to the vulnerable page at: http://localhost:8000/vulapp/ Exploit the parameter at:...
The vulnerability of the QuerySet.order_by() function in the Django web application framework allows a hacker to gain access to confidential data and influence the integrity of the data.
The vulnerability of the QuerySet.orderby function in the Django web application framework relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to gain access to sensitive data and compromise data integrity...
CVE-2026-1312: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier,...
EUVD-2021-0061
Malware in sbrugna...
Updated python-django package fixes security vulnerabilities
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability CVE-2021-28658. In Django 2.2 before 2.2.21, 3.1 before 3.1.9, an...
Django 3.1 < 3.1.13, 3.2 < 3.2.5 SQLi Vulnerability - Linux
Django is prone to an SQL injection SQLi vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
CVE-2021-35042
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...
CVE-2021-35042
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...
Sql injection
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...
CVE-2021-35042
A flaw was found in django. Unsanitized user input passed to QuerySet.orderby could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. The highest threat from this vulnerability is to data...
