An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• djangoproject django4.2 and later · before 4.2.15
• djangoproject django5.0 and later · before 5.0.8

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-34265An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
  61This week
• CVE-2020-7471Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter
  59Plan
• CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
  55Plan
• CVE-2019-14234An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
  53Plan
• CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w
  52Plan
• CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.
  49Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.