CVE-2026-1312

CVE-2026-1312 は、危険度の高い Django SQL インジェクションの脆弱性です。QuerySet.orderby でドットを含む列エイリアスを使用し、FilteredRelation と組み合わせて辞書展開により動的にクエリを構築する際、攻撃者によって悪意のある SQL が注入される可能性があります。 影響を受けるバージョン: Django 6.0 ブランチの 6.0.2 より前のバージョン Django 5.2 ブランチの 5.2.11 より前のバージョン Django 4.2 ブランチの 4.2.28 より前のバージョン 環境の起動...

CVE-2025-57833

Django FilteredRelation Alias SQLインジェクションの脆弱性CVE-2025-57833 Djangoで1年ぶりに発覚したSQLインジェクションの脆弱性です。一見すると、エイリアスが原因で発生するインジェクションのようです（エイリアスはプリコンパイルできないため ）。 この脆弱性は Django フレームワークの FilteredRelation 機能に影響します。QuerySet.annotate または QuerySet.alias メソッドを使用し、Python の辞書展開 kwargs で列エイリアスを指定する場合、SQL...

SQL Injection

Django is vulnerable to SQL injection. The vulnerability is due to improper handling of column aliases containing periods in .QuerySet.orderby when used with FilteredRelation, where unsanitized alias values are included in generated SQL queries and attackers can exploit this by crafting a malicio...

MGASA-2026-0032 Updated python-django packages fix security vulnerabilities

Username enumeration through timing difference in modwsgi authentication handler. CVE-2025-13473 Potential denial-of-service vulnerability via repeated headers when using ASGI. CVE-2025-14550 Potential SQL injection via raster lookups on PostGIS. CVE-2026-1207 Potential denial-of-service...

CVE-2026-1287

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. FilteredRelation is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet methods annotate, aggregat...

GHSA-38CW-85XC-XR9X Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM

Summary An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the column parameter in the order array of query requests. Details...

EUVD-2014-9089

Malware in sbrugna...

CVE-2025-59681

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

PYSEC-2024-70

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

CVE-2014-9264

Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted column alias...

Stack overflow

Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted column alias...

SAP SQL Anywhere .NET Data Provider Column Alias Stack Buffer Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of column aliases. If an application allows untrusted input to be used as the column alias in a query, even if the...