CVE-2021-35042

CVE-2021-35042: уязвимость SQL-инъекции в Django I. Обзор Django — это веб-фреймворк с открытым исходным кодом, написанный на Python и построенный по модели MVC Model-View-Controller. Изначально он был создан для управления новостными веб-сайтами, принадлежащими издательской корпорации Lawrence,...

CVE-2021-35042

CVE-2021-35042 SQL-инъекция через недоверенный ввод в QuerySet.orderby Настройка: Запустите экземпляры, используя: docker-compose up Теперь откройте следующий URL для загрузки образцов данных: http://localhost:8000/vulapp/setup Затем перейдите на уязвимую страницу по адресу:...

The vulnerability of the QuerySet.order_by() function in the Django web application framework allows a hacker to gain access to confidential data and influence the integrity of the data.

The vulnerability of the QuerySet.orderby function in the Django web application framework relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to gain access to sensitive data and compromise data integrity...

CVE-2026-1312: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier,...

EUVD-2021-0061

Malware in sbrugna...

Updated python-django package fixes security vulnerabilities

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability CVE-2021-28658. In Django 2.2 before 2.2.21, 3.1 before 3.1.9, an...

Django 3.1 < 3.1.13, 3.2 < 3.2.5 SQLi Vulnerability - Linux

Django is prone to an SQL injection SQLi vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

Sql injection

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042: Improper Neutralization of Special Elements used in an SQL Command

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

A flaw was found in django. Unsanitized user input passed to QuerySet.orderby could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. The highest threat from this vulnerability is to data...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...