SQL Injection

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. Django RasterField - SQL InjectionCVE-2026-1207djangoproject · CVSS 5.4 · 13% likelycovered by CyberSIXT

   CWE-89

2. An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a…CVE-2022-34265Djangoproject · 74% likely

   CWE-89

3. Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offe…CVE-2020-7471Djangoproject · 66% likely

   CWE-89

4. An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for djan…CVE-2019-14234Djangoproject · 48% likely

   CWE-89

5. Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.CVE-2021-35042Djangoproject · 44% likely

   CWE-89

6. An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably craf…CVE-2025-57833djangoproject · CVSS 7.1 · 28% likely

   CWE-891 bounty report

7. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Orac…CVE-2020-9402Djangoproject · 24% likely

   CWE-89

8. Potential SQL injection via _connector keyword argument in QuerySet and Q objectsCVE-2025-64459djangoproject · CVSS 9.1 · 19% likely

   CWE-89

9. An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in…CVE-2022-28346Djangoproject · 19% likely

   CWE-89

10. A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with…CVE-2022-28347Djangoproject · 2.9% likely

    CWE-89

11. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in co…CVE-2024-42005Djangoproject · CVSS 9.8 · 1.5% likely

    CWE-893 bounty reports

12. An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle databa…CVE-2024-53908Djangoproject · CVSS 9.8 · 1.4% likely

    CWE-891 bounty report

13. Potential SQL injection in FilteredRelation column aliases on PostgreSQLCVE-2025-13372djangoproject · CVSS 4.3 · 0.9% likely

    CWE-89

14. Potential SQL injection via QuerySet.order_by and FilteredRelationCVE-2026-1312djangoproject · CVSS 5.4 · 0.9% likelycovered by CyberSIXT

    CWE-89

15. Potential SQL injection in column aliases via control charactersCVE-2026-1287djangoproject · CVSS 5.4 · 0.8% likelycovered by CyberSIXT

    CWE-89

16. An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are…CVE-2025-59681djangoproject · CVSS 7.1 · 0.7% likely

    CWE-891 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.