Every CVE Search/ Get API key

CVE-2025-13372

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

4.3 MediumFix available

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.93%Up 0.9 points since Dec 3, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.3

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2025-200249 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
EUVD-2025-200249
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rqw2-ghq9-44m7 4.3

Django is vulnerable to SQL injection in column aliases

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
GHSA-rqw2-ghq9-44m7
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2025-13372 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
ALPINE-CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSV 4.3

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
Show 28 moreShow less
OSVDEBIAN-CVE-2025-13372 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
DEBIAN-CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-rqw2-ghq9-44m7 4.3

Django is vulnerable to SQL injection in column aliases

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
GHSA-rqw2-ghq9-44m7
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVOESA-2025-2847 4.3

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2025-13372)

Record
OESA-2025-2847
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2848 4.3

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2025-13372)

Record
OESA-2025-2848
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2849 4.3

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2025-13372)

Record
OESA-2025-2849
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2025-2850 7.5

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2025-13372)

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64460)

Record
OESA-2025-2850
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2851 7.5

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2025-13372)

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML Deserializer. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64460)

Record
OESA-2025-2851
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2025-104 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
PYSEC-2025-104
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-13372 4.3

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
UBUNTU-CVE-2025-13372
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVBIT-django-2025-13372 No score

Potential SQL injection in FilteredRelation column aliases on PostgreSQL

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

Record
BIT-django-2025-13372
Updated
2026-11-02
OSVCLSA-2026-1788166978 No score

TuxCare security update for django (6 CVEs)

TuxCare rebuilt django to address 6 CVEs. Fixed in 5.1.10.post3+tuxcare.

Record
CLSA-2026-1788166978
Updated
2026-11-02
OSVCLSA-2026-1788167080 No score

TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post9+tuxcare.

Record
CLSA-2026-1788167080
Updated
2026-11-02
OSVCLSA-2026-1788348294 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post16+tuxcare.

Record
CLSA-2026-1788348294
Updated
2026-11-02
OSVCLSA-2026-1789453540 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post6+tuxcare.

Record
CLSA-2026-1789453540
Updated
2026-11-02
OSVCLSA-2026-1789454358 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post7+tuxcare.

Record
CLSA-2026-1789454358
Updated
2026-11-02
OSVCLSA-2026-1789538853 No score

TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post10+tuxcare.

Record
CLSA-2026-1789538853
Updated
2026-11-02
OSVCLSA-2026-1789636652 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.2.post9+tuxcare.

Record
CLSA-2026-1789636652
Updated
2026-11-02
OSVCLSA-2026-1791271957 No score

TuxCare security update for django (6 CVEs)

TuxCare rebuilt django to address 6 CVEs. Fixed in 5.0.1.post12+tuxcare.

Record
CLSA-2026-1791271957
Updated
2026-11-02
OSVCLSA-2026-1791272123 No score

TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.post17+tuxcare.

Record
CLSA-2026-1791272123
Updated
2026-11-02
OSVCLSA-2026-1793696695 No score

TuxCare security update for django (9 CVEs)

TuxCare rebuilt django to address 9 CVEs. Fixed in 3.2.25.post14+tuxcare.

Record
CLSA-2026-1793696695
Updated
2026-11-03
OSVMGASA-2025-0320 No score

Updated python-django packages fix security vulnerabilities

Potential SQL injection in FilteredRelation column aliases on PostgreSQL. (CVE-2025-13372) Potential denial-of-service vulnerability in XML serializer text extraction. (CVE-2025-64460)

Record
MGASA-2025-0320
Updated
2026-11-02
OSVopenSUSE-SU-2025:15805-1 No score

python311-Django-5.2.9-1.1 on GA media

These are all security issues fixed in the python311-Django-5.2.9-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15805-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15806-1 No score

python311-Django4-4.2.27-1.1 on GA media

These are all security issues fixed in the python311-Django4-4.2.27-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15806-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20153-1 No score

Security update for python-Django

This update for python-Django fixes the following issues:

  • CVE-2025-64459: Fixed a potential SQL injection via _connector keyword argument in QuerySet and Q objects (bsc#1252926)
  • CVE-2025-13372,CVE-2025-64460: Fixed Denial of Service in 'django.core.serializers.xml_serializer.getInnerText()' (bsc#1254437)
Record
openSUSE-SU-2025:20153-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10005-1 No score

python312-Django6-6.0-1.1 on GA media

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10005-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11270-1 No score

python313-Django5-5.2.16-1.1 on GA media

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11270-1
Updated
2026-11-02
OSVSUSE-SU-2025:4384-1 No score

Security update for python-Django

This update for python-Django fixes the following issues:

  • CVE-2025-13372: Fixed SQL Injection in FilteredRelation (bsc#1254437)
  • CVE-2025-64460: Fixed denial of service via specially crafted XML input in django.core.serializers.xml_serializer.getInnerText() (bsc#1254437)
Record
SUSE-SU-2025:4384-1
Updated
2026-11-02
OSVUSN-7903-1 No score

python-django vulnerabilities

It was discovered that Django incorrectly handled certain characters in the FilteredRelation object. An attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-13372)

Seokchan Yoon discovered that Django inefficiently handled deserialization of XML objects. An attacker could possibly use this issue to cause Django to use excessive resources, causing a denial of service. (CVE-2025-64460)

Record
USN-7903-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 5.2a1 up to 5.2.9
5.2.9
django
PyPI
 5.1a1 up to 5.1.15
5.1.15
django
PyPI
 4.2a1 up to 4.2.27
4.2.27
py3-django
Alpine:v3.22
 before 4.2.27-r0
4.2.27-r0
py3-django
Alpine:v3.23
 before 4.2.27-r0
4.2.27-r0
py3-django
Alpine:v3.24
 before 4.2.27-r0
4.2.27-r0
django
Bitnami
 4.2.0 up to 4.2.27, 5.1.0 up to 5.1.15, 5.2.0 up to 5.2.9
4.2.275.1.155.2.9
django
TuxCare:PyPI
From an advisory covering 6 CVEs
 5.1.10 up to 5.1.10.post3+tuxcare, plus listed versions
5.1.10.post1+tuxcare5.1.10.post2+tuxcare
5.1.10.post3+tuxcare
django
TuxCare:PyPI
From an advisory covering 5 CVEs
 4.2 up to 4.2.post9+tuxcare, plus listed versions
4.2.post1+tuxcare4.2.post2+tuxcare4.2.post3+tuxcare4.2.post4+tuxcare4.2.post5+tuxcare4.2.post6+tuxcare4.2.post7+tuxcare4.2.post8+tuxcare
4.2.post9+tuxcare
django
TuxCare:PyPI
 4.0 up to 4.0.post16+tuxcare, plus listed versions
4.0.post1+tuxcare4.0.post10+tuxcare4.0.post11+tuxcare4.0.post12+tuxcare4.0.post13+tuxcare
Show 10 moreShow less
4.0.post14+tuxcare4.0.post15+tuxcare4.0.post2+tuxcare4.0.post3+tuxcare4.0.post4+tuxcare4.0.post5+tuxcare4.0.post6+tuxcare4.0.post7+tuxcare4.0.post8+tuxcare4.0.post9+tuxcare
4.0.post16+tuxcare
Show 42 moreShow less
Affected packages
PackageAffectedFixed
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 5.1.9 up to 5.1.9.post6+tuxcare, plus listed versions
5.1.9.post1+tuxcare5.1.9.post2+tuxcare5.1.9.post3+tuxcare5.1.9.post4+tuxcare5.1.9.post5+tuxcare
5.1.9.post6+tuxcare
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 5.1.4 up to 5.1.4.post7+tuxcare, plus listed versions
5.1.4.post1+tuxcare5.1.4.post2+tuxcare5.1.4.post3+tuxcare5.1.4.post4+tuxcare5.1.4.post5+tuxcare5.1.4.post6+tuxcare
5.1.4.post7+tuxcare
django
TuxCare:PyPI
From an advisory covering 3 CVEs
 5.1 up to 5.1.post10+tuxcare, plus listed versions
5.1.post1+tuxcare5.1.post2+tuxcare5.1.post3+tuxcare5.1.post4+tuxcare5.1.post5+tuxcare
Show 4 moreShow less
5.1.post6+tuxcare5.1.post7+tuxcare5.1.post8+tuxcare5.1.post9+tuxcare
5.1.post10+tuxcare
django
TuxCare:PyPI
 5.0.2 up to 5.0.2.post9+tuxcare, plus listed versions
5.0.2.post1+tuxcare5.0.2.post2+tuxcare5.0.2.post3+tuxcare5.0.2.post4+tuxcare5.0.2.post5+tuxcare5.0.2.post6+tuxcare5.0.2.post7+tuxcare5.0.2.post8+tuxcare
5.0.2.post9+tuxcare
django
TuxCare:PyPI
From an advisory covering 6 CVEs
 5.0.1 up to 5.0.1.post12+tuxcare, plus listed versions
5.0.1.post1+tuxcare5.0.1.post10+tuxcare5.0.1.post11+tuxcare5.0.1.post2+tuxcare5.0.1.post3+tuxcare
Show 6 moreShow less
5.0.1.post4+tuxcare5.0.1.post5+tuxcare5.0.1.post6+tuxcare5.0.1.post7+tuxcare5.0.1.post8+tuxcare5.0.1.post9+tuxcare
5.0.1.post12+tuxcare
django
TuxCare:PyPI
From an advisory covering 3 CVEs
 5.0 up to 5.0.post17+tuxcare, plus listed versions
5.0.post1+tuxcare5.0.post10+tuxcare5.0.post11+tuxcare5.0.post12+tuxcare5.0.post13+tuxcare
Show 11 moreShow less
5.0.post14+tuxcare5.0.post15+tuxcare5.0.post16+tuxcare5.0.post2+tuxcare5.0.post3+tuxcare5.0.post4+tuxcare5.0.post5+tuxcare5.0.post6+tuxcare5.0.post7+tuxcare5.0.post8+tuxcare5.0.post9+tuxcare
5.0.post17+tuxcare
django
TuxCare:PyPI
From an advisory covering 9 CVEs
 3.2.25 up to 3.2.25.post14+tuxcare, plus listed versions
3.2.25.post1+tuxcare3.2.25.post10+tuxcare3.2.25.post11+tuxcare3.2.25.post12+tuxcare3.2.25.post13+tuxcare
Show 8 moreShow less
3.2.25.post2+tuxcare3.2.25.post3+tuxcare3.2.25.post4+tuxcare3.2.25.post5+tuxcare3.2.25.post6+tuxcare3.2.25.post7+tuxcare3.2.25.post8+tuxcare3.2.25.post9+tuxcare
3.2.25.post14+tuxcare
python-django
Debian:12
 before 3:3.2.25-0+deb12u1, plus listed versions
3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1
3:3.2.25-0+deb12u1
python-django
Debian:13
 before 3:4.2.27-0+deb13u1, plus listed versions
3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1
3:4.2.27-0+deb13u1
python-django
Debian:14
 before 3:4.2.27-1, plus listed versions
3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1
3:4.2.27-1
python-django
Debian:13
From an advisory covering 6 CVEs
 before 3:4.2.27-0+deb13u1, plus listed versions
3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1
3:4.2.27-0+deb13u1
python-django
Debian:12
From an advisory covering 23 CVEs
 before 3:3.2.25-0+deb12u1, plus listed versions
3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1
3:3.2.25-0+deb12u1
django
PyPI
 5.2a1 up to 5.2.9, plus listed versions
5.25.2.15.2.25.2.35.2.4
Show 6 moreShow less
5.2.55.2.65.2.75.2.85.2b15.2rc1
5.2.9
django
PyPI
 5.1a1 up to 5.1.15, plus listed versions
5.15.1.15.1.105.1.115.1.12
Show 12 moreShow less
5.1.135.1.145.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.1b15.1rc1
5.1.15
django
PyPI
 4.2a1 up to 4.2.27, plus listed versions
4.24.2.14.2.104.2.114.2.12
Show 24 moreShow less
4.2.134.2.144.2.154.2.164.2.174.2.184.2.194.2.24.2.204.2.214.2.224.2.234.2.244.2.254.2.264.2.34.2.44.2.54.2.64.2.74.2.84.2.94.2b14.2rc1
4.2.27
python-django
Mageia:9
From an advisory covering 2 CVEs
 before 4.1.13-1.9.mga9
4.1.13-1.9.mga9
python-django
openEuler:24.03-LTS-SP2
 before 4.2.15-11.oe2403sp2
4.2.15-11.oe2403sp2
python-django
openEuler:22.03-LTS-SP3
 before 4.2.15-11.oe2203sp3
4.2.15-11.oe2203sp3
python-django
openEuler:22.03-LTS-SP4
 before 4.2.15-11.oe2203sp4
4.2.15-11.oe2203sp4
python-django
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 4.2.15-11.oe2403
4.2.15-11.oe2403
python-django
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 4.2.15-11.oe2403sp1
4.2.15-11.oe2403sp1
django
PyPI
 4.2 up to 4.2.27, 5.1 up to 5.1.15, 5.2 up to 5.2.9, plus listed versions
4.2.14.2.104.2.114.2.124.2.13
Show 43 moreShow less
4.2.144.2.154.2.164.2.174.2.184.2.194.2.24.2.204.2.214.2.224.2.234.2.244.2.254.2.264.2.34.2.44.2.54.2.64.2.74.2.84.2.95.1.15.1.105.1.115.1.125.1.135.1.145.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.15.2.25.2.35.2.45.2.55.2.65.2.75.2.8
4.2.275.1.155.2.9
python-Django
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 2 CVEs
 before 4.2.11-150600.3.44.1
4.2.11-150600.3.44.1
python-Django
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 4.2.11-150600.3.44.1
4.2.11-150600.3.44.1
python-Django
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 4.2.11-150600.3.44.1
4.2.11-150600.3.44.1
python-django
Ubuntu:Pro:20.04:LTS
 before 2:2.2.12-1ubuntu0.29+esm6, plus listed versions
1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1
Show 36 moreShow less
2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.272:2.2.12-1ubuntu0.282:2.2.12-1ubuntu0.292:2.2.12-1ubuntu0.29+esm12:2.2.12-1ubuntu0.29+esm22:2.2.12-1ubuntu0.29+esm32:2.2.12-1ubuntu0.29+esm42:2.2.12-1ubuntu0.29+esm5
2:2.2.12-1ubuntu0.29+esm6
python-django
Ubuntu:22.04:LTS
 before 2:3.2.12-2ubuntu1.24, plus listed versions
2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2
Show 21 moreShow less
2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.162:3.2.12-2ubuntu1.172:3.2.12-2ubuntu1.182:3.2.12-2ubuntu1.192:3.2.12-2ubuntu1.202:3.2.12-2ubuntu1.212:3.2.12-2ubuntu1.222:3.2.12-2ubuntu1.23
2:3.2.12-2ubuntu1.24
python-django
Ubuntu:24.04:LTS
 before 3:4.2.11-1ubuntu1.13, plus listed versions
3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1
Show 12 moreShow less
3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.53:4.2.11-1ubuntu1.63:4.2.11-1ubuntu1.73:4.2.11-1ubuntu1.83:4.2.11-1ubuntu1.93:4.2.11-1ubuntu1.103:4.2.11-1ubuntu1.113:4.2.11-1ubuntu1.12
3:4.2.11-1ubuntu1.13
python-django
Ubuntu:25.10
 before 3:5.2.4-1ubuntu2.2, plus listed versions
3:4.2.18-1ubuntu13:4.2.18-1ubuntu1.13:5.2.4-13:5.2.4-1ubuntu13:5.2.4-1ubuntu23:5.2.4-1ubuntu2.1
3:5.2.4-1ubuntu2.2
python-django
Ubuntu:26.04:LTS
 before 3:5.2.9-0ubuntu1, plus listed versions
3:5.2.4-1ubuntu23:5.2.4-1ubuntu3
3:5.2.9-0ubuntu1
python-django
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 1.6.11-0ubuntu1.3+esm9, plus listed versions
1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1
Show 26 moreShow less
1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.51.6.1-2ubuntu0.61.6.1-2ubuntu0.81.6.1-2ubuntu0.91.6.1-2ubuntu0.101.6.1-2ubuntu0.111.6.1-2ubuntu0.121.6.1-2ubuntu0.131.6.1-2ubuntu0.141.6.1-2ubuntu0.151.6.1-2ubuntu0.161.6.11-0ubuntu11.6.11-0ubuntu1.11.6.11-0ubuntu1.21.6.11-0ubuntu1.31.6.11-0ubuntu1.3+esm11.6.11-0ubuntu1.3+esm21.6.11-0ubuntu1.3+esm31.6.11-0ubuntu1.3+esm41.6.11-0ubuntu1.3+esm51.6.11-0ubuntu1.3+esm61.6.11-0ubuntu1.3+esm71.6.11-0ubuntu1.3+esm8
1.6.11-0ubuntu1.3+esm9
python-django
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 1.8.7-1ubuntu5.15+esm10, plus listed versions
1.7.9-1ubuntu51.8.5-2ubuntu11.8.7-1ubuntu11.8.7-1ubuntu21.8.7-1ubuntu3
Show 24 moreShow less
1.8.7-1ubuntu41.8.7-1ubuntu51.8.7-1ubuntu5.11.8.7-1ubuntu5.21.8.7-1ubuntu5.41.8.7-1ubuntu5.51.8.7-1ubuntu5.61.8.7-1ubuntu5.71.8.7-1ubuntu5.81.8.7-1ubuntu5.91.8.7-1ubuntu5.101.8.7-1ubuntu5.111.8.7-1ubuntu5.121.8.7-1ubuntu5.131.8.7-1ubuntu5.141.8.7-1ubuntu5.151.8.7-1ubuntu5.15+esm11.8.7-1ubuntu5.15+esm31.8.7-1ubuntu5.15+esm41.8.7-1ubuntu5.15+esm51.8.7-1ubuntu5.15+esm61.8.7-1ubuntu5.15+esm71.8.7-1ubuntu5.15+esm81.8.7-1ubuntu5.15+esm9
1.8.7-1ubuntu5.15+esm10
python-django
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 1:1.11.11-1ubuntu1.21+esm13, plus listed versions
1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1
Show 32 moreShow less
1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm11:1.11.11-1ubuntu1.21+esm21:1.11.11-1ubuntu1.21+esm31:1.11.11-1ubuntu1.21+esm41:1.11.11-1ubuntu1.21+esm51:1.11.11-1ubuntu1.21+esm61:1.11.11-1ubuntu1.21+esm71:1.11.11-1ubuntu1.21+esm81:1.11.11-1ubuntu1.21+esm91:1.11.11-1ubuntu1.21+esm101:1.11.11-1ubuntu1.21+esm111:1.11.11-1ubuntu1.21+esm12
1:1.11.11-1ubuntu1.21+esm13
python-django
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 2:2.2.12-1ubuntu0.29+esm6, plus listed versions
1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1
Show 36 moreShow less
2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.272:2.2.12-1ubuntu0.282:2.2.12-1ubuntu0.292:2.2.12-1ubuntu0.29+esm12:2.2.12-1ubuntu0.29+esm22:2.2.12-1ubuntu0.29+esm32:2.2.12-1ubuntu0.29+esm42:2.2.12-1ubuntu0.29+esm5
2:2.2.12-1ubuntu0.29+esm6
python-django
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2:3.2.12-2ubuntu1.24, plus listed versions
2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2
Show 21 moreShow less
2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.162:3.2.12-2ubuntu1.172:3.2.12-2ubuntu1.182:3.2.12-2ubuntu1.192:3.2.12-2ubuntu1.202:3.2.12-2ubuntu1.212:3.2.12-2ubuntu1.222:3.2.12-2ubuntu1.23
2:3.2.12-2ubuntu1.24
python-django
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 3:4.2.11-1ubuntu1.13, plus listed versions
3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1
Show 12 moreShow less
3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.53:4.2.11-1ubuntu1.63:4.2.11-1ubuntu1.73:4.2.11-1ubuntu1.83:4.2.11-1ubuntu1.93:4.2.11-1ubuntu1.103:4.2.11-1ubuntu1.113:4.2.11-1ubuntu1.12
3:4.2.11-1ubuntu1.13
python-django
Ubuntu:25.10
From an advisory covering 2 CVEs
 before 3:5.2.4-1ubuntu2.2, plus listed versions
3:4.2.18-1ubuntu13:4.2.18-1ubuntu1.13:5.2.4-13:5.2.4-1ubuntu13:5.2.4-1ubuntu23:5.2.4-1ubuntu2.1
3:5.2.4-1ubuntu2.2
python-Django
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 5.2.9-1.1
5.2.9-1.1
python-Django4
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 4.2.27-1.1
4.2.27-1.1
python-Django
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 5.2.4-bp160.4.1
5.2.4-bp160.4.1
python-Django6
openSUSE:Tumbleweed
From an advisory covering 70 CVEs
 before 6.0-1.1
6.0-1.1
python-Django5
openSUSE:Tumbleweed
From an advisory covering 93 CVEs
 before 5.2.16-1.1
5.2.16-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliasesOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13372 is a medium vulnerability (CVSS 4.3) in Djangoproject Django, published December 2, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in django 5.2.9.

References

Show 119 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open