EUVD-2022-0088

Malicious code in bioql PyPI...

Updated python-django packages fix security vulnerability

Potential SQL injection in QuerySet.annotate, aggregate, and extra CVE-2022-28346 Potential SQL injection via QuerySet.explainoptions on PostgreSQL QuerySet.explain CVE-2022-28347...

SQL Injection in Django

A SQL injection issue was discovered in QuerySet.explain in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary with dictionary expansion as the options argument, and placing the injection payload in an option name...

CVE-2022-28347: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection issue was discovered in QuerySet.explain in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary with dictionary expansion as the options argument, and placing the injection payload in an option name...

CVE-2022-28347

CVE-2022-28347 is a Django SQL injection vulnerability affecting QuerySet.explain() when a crafted dictionary with dictionary expansion is passed as the options argument and the injection payload is placed in an option name. Affected versions: Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 ...