OESA-2025-2234 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

OESA-2025-2236 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

OESA-2025-2235 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

Django: SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects

A critical SQL injection vulnerability was discovered in the Django ORM's handling of Q objects. The internal WhereNode.assql method used unsafe string formatting to inject the query connector, which could be controlled by an attacker through the connector key when creating a Q object. This allow...

Python Library Django 4.2.x < 4.2.24 / 5.1.x < 5.1.12 / 5.2.x < 5.2.6 SQLi

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.24, 5.1.x prior to 5.1.12, or 5.2.x prior to 5.2.6. It is, therefore, affected by a SQL injection vulnerability as disclosed in Django's September 3rd, 2025 security advisory. FilteredRelation is subject to SQL...

security-research

It is an offensive tool for web applications. The repository con...

Linux Distros Unpatched Vulnerability : CVE-2023-28117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentr...

Exploit for CVE-2025-57833

It is a...

Mageia: Security Advisory (MGASA-2025-0229)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0229 Updated python-django packages fix security vulnerability

Potential SQL injection in FilteredRelation column aliases. CVE-2025-57833...

Updated python-django packages fix security vulnerability

Potential SQL injection in FilteredRelation column aliases. CVE-2025-57833...

Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

GHSA-6W2R-R2M5-XQ5W Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

openSUSE Security Advisory (SUSE-SU-2025:03074-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2025-57833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases,...

Django: Path traversal via archive.extract - CVE 2021-3281 incomplete patch

A vulnerability was discovered in the "extract" function of the ZipArchive and TarArchive classes in the Django framework. The vulnerability was caused by the use of the "abspath" function, which removes terminating path separators. This made the guard logic protection insufficient to protect...

Exploit for CVE-2025-57833

Django SQL Injection Test Environment CVE-2025-57833 This i...

SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:03074-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03074-1 advisory. - CVE-2025-57833: Fixed potential SQL injection in FilteredRelation column aliases bsc1248810 Tenable has extracted the preceding...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Django vulnerability (USN-7736-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7736-1 advisory. It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to perform a SQL...

Security update for python-Django (important)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2025:0335-1 Rating: important References: 1248810 Cross-References: CVE-2025-57833 CVSS scores: CVE-2025-57833 SUSE: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports...