CVE-2025-57833
26Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 16%
probabilidade de exploração
16%top 3% das CVEs
exploração observada
nãonenhuma fonte reporta
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
djangoproject · DjangoReferências
https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/g/django-announcehttps://lists.debian.org/debian-lts-announce/2025/09/msg00017.htmlhttps://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898https://www.djangoproject.com/weblog/2025/sep/03/security-releases/http://www.openwall.com/lists/oss-security/2025/09/03/3