CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL 注入 环境初始化 root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 漏洞复现 root@kitploit: 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demouser" union...

CVE-2022-28346

CVE-2022-28346 PoC 影响： QuerySet.annotate、aggregate和extra中可能存在SQL注入漏洞。 安装 root@kitploit: poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC root@kitploit: ?field=poc.title" FROM "pocblog" union SELECT...

CVE-2021-35042

CVE-2021-35042 Inyección SQL a través de la entrada no sanitizada QuerySet.orderby Configuración: Ejecute ./setup.sh para la configuración inicial Abra la imagen de Docker para iniciar la base de datos: docker exec -it containerid /bin/bash Y ejecute los siguientes comandos: root@kitploit: python...

CVE-2022-28346

CVE-2022-28346 在 Django 包中发现了一个漏洞，该漏洞导致 SQL 注入。此漏洞允许攻击者使用包含恶意 SQL 查询的精心构造的字典来完全破坏数据库。 目录 CVE-2022-28346 描述 环境 概念验证与利用 参考资料 您将在代码仓库中找到关于 CVE-2022-28346 的详细分析报告（PDF）。 描述 CVE-2022-28346 是在 Django 的多个版本中发现的一个严重漏洞，Django 是一个流行的 Python Web 框架。该漏洞特别影响 Django 2.2 版本（2.2.28 之前）、3.2 版本（3.2.13 之前）以及 4.0...

CVE-2022-28346

CVE-2022-28346 QuerySet.annotate、aggregate 和 extra 中的 SQL 注入漏洞 设置： 运行 ./setup.sh 进行初始设置 打开 Docker 镜像以初始化数据库： docker exec -it containerid /bin/bash 然后运行以下命令： root@kitploit: python manage.py makemigrations cve202228346 python manage.py migrate 启动实例： docker-compose up 现在打开以下 URL 加载示例数据：...

CVE-2025-57833

CVE-2025-57833 针对 CVE-2025–57833 的示例易受攻击应用程序 Django 4.2 至 4.2.24 之前版本、5.1 至 5.1.12 之前版本以及 5.2 至 5.2.6 之前版本存在 SQL 注入漏洞， 该漏洞源于将字典展开作为 kwargs 传递给 QuerySet.annotate 或 QuerySet.alias 时引发。 目前仍在开发中。 本内容仅供教育用途。...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459 测试平台 一个自包含的 Django CVE-2025-64459 测试平台。演示通过字典展开（dictionary expansion）进行的 QuerySet.filter 参数注入，使用 Docker。 关于漏洞 CVE-2025-64459 是 Django 中一个高严重性漏洞（特指版本 5.1.14），当用户输入通过字典展开（例如 request.GET）直接传递给 QuerySet.filter 时，允许参数注入。 攻击者可以注入内部参数如 connector 来操纵查询逻辑（例如将 AND 改为...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

CVE-2019-14234

POC-Django JSONField/HStoreField SQL注入漏洞利用 CVE-2019-14234 Django于2019年8月1日发布了一个安全更新，修复了JSONField和HStoreField这两个模型字段中的SQL注入漏洞。 参考链接： https://www.djangoproject.com/weblog/2019/aug/01/security-releases/ https://www.leavesongs.com/PENETRATION/django-jsonfield-cve-2019-14234.html...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-016807)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016807 advisory. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods QuerySet.filter, QuerySet.exclude, and QuerySet.get, and the class...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-016788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016788 advisory. An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...

Django: Django: SQL injection via crafted column aliases in QuerySet.order_by()

A flaw was found in Django. A remote attacker could exploit a SQL injection vulnerability in the .QuerySet.orderby method. This occurs when column aliases containing periods are used, and the same alias is also present in FilteredRelation via a specially crafted dictionary. Successful exploitatio...