CVE-2021-35042

CVE-2021-35042: Vulnérabilité d'injection SQL dans Django I. Aperçu Django est un framework d'application Web open source, écrit en Python, construit selon le modèle MVC Model - View - Controller. Il a été initialement conçu pour gérer les sites Web de contenu d'actualités appartenant à la sociét...

CVE-2021-35042

CVE-2021-35042 Injection SQL via une entrée non fiable dans QuerySet.orderby Mise en place : Démarrez les instances en utilisant : docker-compose up Ouvrez maintenant l'URL suivante pour charger les données d'exemple : http://localhost:8000/vulapp/setup Accédez ensuite à la page vulnérable via :...

The vulnerability of the QuerySet.order_by() function in the Django web application framework allows a hacker to gain access to confidential data and influence the integrity of the data.

The vulnerability of the QuerySet.orderby function in the Django web application framework relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to gain access to sensitive data and compromise data integrity...

CVE-2026-1312: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. Earlier,...

EUVD-2021-0061

Malware in sbrugna...

Updated python-django package fixes security vulnerabilities

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability CVE-2021-28658. In Django 2.2 before 2.2.21, 3.1 before 3.1.9, an...

Django 3.1 < 3.1.13, 3.2 < 3.2.5 SQLi Vulnerability - Linux

Django is prone to an SQL injection SQLi vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

Sql injection

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042: Improper Neutralization of Special Elements used in an SQL Command

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

CVE-2021-35042

A flaw was found in django. Unsanitized user input passed to QuerySet.orderby could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. The highest threat from this vulnerability is to data...

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...