CVE-2019-14234

Exploitation de la vulnérabilité d'injection SQL dans JSONField/HStoreField de Django CVE-2019-14234 Django a publié une mise à jour de sécurité le 1er août 2019, corrigeant une vulnérabilité d'injection SQL dans les deux champs de modèle JSONField et HStoreField. Lien de référence :...

CVE-2021-35042

CVE-2021-35042 SQL-инъекция через несанитизированный ввод QuerySet.orderby Настройка: Запустите ./setup.sh для начальной настройки Откройте Docker-образ для инициализации базы данных: docker exec -it containerid /bin/bash и выполните следующие команды: python manage.py makemigrations cve202135042...

CVE-2022-28346

CVE-2022-28346 PoC Impact: Potentielle injection SQL dans QuerySet.annotate, aggregate et extra. Installation poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT...

CVE-2022-28346

CVE-2022-28346 В пакете Django была обнаружена ошибка, приводящая к SQL-инъекции. Эта ошибка позволяет злоумышленнику, использующему специально созданный словарь с вредоносными SQL-запросами, полностью скомпрометировать базу данных. Содержание CVE-2022-28346 Описание Окружение Доказательство...

CVE-2022-28346

CVE-2022-28346 Injection SQL dans QuerySet.annotate, aggregate et extra Installation : Exécutez ./setup.sh pour l'installation initiale Ouvrez l'image Docker pour initialiser la base de données : docker exec -it containerid /bin/bash Et exécutez les commandes suivantes : python manage.py...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra injection SQL Initialisation de l'environnement 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Reproduction de la vulnérabilité 访问http://x.x.x.x:8000/demo POC:...

CVE-2021-35042

CVE-2021-35042: Уязвимость SQL-инъекции в Django I. Обзор Django — это веб-фреймворк с открытым исходным кодом, написанный на Python и построенный по модели MVC Model - View - Controller. Изначально он был создан для управления новостными веб-сайтами, принадлежащими издательской корпорации...

CVE-2025-57833

CVE-2025-57833 Пример уязвимого приложения для CVE-2025–57833 Django 4.2 до 4.2.24, 5.1 до 5.1.12 и 5.2 до 5.2.6 уязвим к SQL-инъекции через расширение словаря, когда kwargs передаются в QuerySet.annotate или QuerySet.alias В настоящее время работа в процессе. Этот материал предназначен только дл...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459 테스트베드 Django CVE-2025-64459를 위한 독립형 테스트베드입니다. Docker를 이용한 딕셔너리 확장을 통해 QuerySet.filter 파라미터 인젝션을 시연합니다. 취약점 정보 CVE-2025-64459 는 Django 특히 5.1.14 미만 버전에서 발생하는 높은 심각도의 취약점으로, 사용자 입력이 딕셔너리 확장예: request.GET을 통해 직접 전달될 때 QuerySet.filter에 파라미터 인젝션을 허용합니다. 공격자는 connector와 같은 내부 파라미터...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595: Not Failing Securely

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The values and valueslist methods on models with a JSONField are vulnerable to SQL injection when column aliases are used, due to a crafted JSON object key being passed as an argument...

CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

PT-2026-80987

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label studio/tasks/api.py declares queryset = Annotation.objects.all and provides no get queryset override, so the default lookup retrieves any annotation by primary key. The view's...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099460 advisory. An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitab...

CVE-2026-18275 Authorization Bypass Through User-Controlled Key in eScriptorium

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...