CVE-2022-28346

CVE-2022-28346 PoC 影响： QuerySet.annotate、aggregate和extra中可能存在SQL注入漏洞。 安装 root@kitploit: poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC root@kitploit: ?field=poc.title" FROM "pocblog" union SELECT...

Django-faille-CVE-2025-57833_test

通过 Django 中的别名进行 SQL 注入漏洞测试 定义：什么是别名？ 别名 是 SQL 查询中给列或聚合结果起的名称。 在 Django 中，别名通过 annotate 或 alias 方法用于命名计算字段。 示例： root@kitploit: from django.db.models import Count books = Book.objects.annotatebookcount=Count'id' 这里，bookcount 是 Count'id' 结果的别名 。 这允许为计算列获取一个可读的名称。 通过 shell 插入数据 为快速操作，可以通过 shell 插入数据...

CVE-2022-28346

CVE-2022-28346 QuerySet.annotate、aggregate 和 extra 中的 SQL 注入漏洞 设置： 运行 ./setup.sh 进行初始设置 打开 Docker 镜像以初始化数据库： docker exec -it containerid /bin/bash 然后运行以下命令： root@kitploit: python manage.py makemigrations cve202228346 python manage.py migrate 启动实例： docker-compose up 现在打开以下 URL 加载示例数据：...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL 注入 环境初始化 root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 漏洞复现 root@kitploit: 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demouser" union...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

Use After Free

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

Django: Django: SQL Injection via crafted column aliases

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-006300)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006300 advisory. An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a...

Django: Django: SQL Injection via crafted column aliases

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

SQL Injection

Django is vulnerable to SQL injection. The vulnerability is due to improper handling of column aliases in FilteredRelation when using dictionary expansion kwargs, where crafted keys containing control characters can manipulate SQL generation in methods such as annotate, aggregate, extra, values,...

Juniper Junos OS Vulnerability (JSA100096)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100096 advisory. - An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high...

CVE-2026-1287

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to QuerySet methods like annotate or values, it can lead to the...

CVE-2026-1287

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet methods annotate, aggregat...

SQL Injection

Django is vulnerable to SQL Injection. The vulnerability is due to improper handling of column aliases in FilteredRelation when expanding user-controlled dictionaries passed to QuerySet.annotate or QuerySet.alias, which allows an attacker to inject crafted SQL on PostgreSQL...

BIT-DJANGO-2025-13372 Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet.annotate or QuerySet.alias on PostgreSQL. Earlier...

CVE-2025-13372

A flaw was found in Django. This vulnerability allows Structured Query Language SQL injection in column aliases via a suitably crafted dictionary with dictionary expansion, as the kwargs passed to QuerySet.annotate or QuerySet.alias on PostgreSQL. Mitigation Mitigation for this issue is either no...

OESA-2025-2847 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

OESA-2025-2848 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

OESA-2025-2849 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...