https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T14:19:00.753428+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2022-28347 CVE-2022-28347 2026-10-06T14:19:02.689841+00:00

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

 https://vulnerability.circl.lu/vuln/usn-5373-1 USN-5373-1 — python-django vulnerabilities 2026-10-06T14:19:02.689987+00:00

Affected: Ubuntu:18.04:LTS: python-django, Ubuntu:20.04:LTS: python-django

It was discovered that Django incorrectly handled certain certain column aliases in the QuerySet.annotate(), aggregate(), and extra() methods. A remote attacker could possibly use this issue to perform an SQL injection attack. (CVE-2022-28346)

It was discovered that Django incorrectly handled certain option names in the QuerySet.explain() method. A remote attacker could possibly use this issue to perform an SQL injection attack. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-28347)

It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote attacker could possibly use this issue to perform a header injection attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-32052)