ORM Leak · passage 2 of 12

Django (Python)

1 code block · ORM Leak/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

The following code is a basic example of an ORM querying the database.

users = User.objects.filter(**request.data)
serializer = UserSerializer(users, many=True)

The problem lies in how the Django ORM uses keyword parameter syntax to build QuerySets. By utilizing the unpack operator (`**`), users can dynamically control the keyword arguments passed to the filter method, allowing them to filter results according to their needs.

Every one of the 12 is a mark on the map. Named now: 1 to 12, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.