Vulnerability Database
296,720
Total vulnerabilities in the database
CVE-2025-59681
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
- https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/oct/01/security-releases
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime