Every CVE Search/ Get API key

CVE-2025-57833

Django is subject to SQL injection through its column aliases

7.1 HighPublic exploitFix available

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

28.3%Up 28.2 points since Sep 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
CVE-2025-57833
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2025-26641 7.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
EUVD-2025-26641
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6w2r-r2m5-xq5w 7.1

Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
GHSA-6w2r-r2m5-xq5w
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 7.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
CVE-2025-57833
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2025-57833 8.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
ALPINE-CVE-2025-57833
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
CVE-2025-57833
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-89
Updated
2026-11-02
Show 38 moreShow less
OSVDEBIAN-CVE-2025-57833 8.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
DEBIAN-CVE-2025-57833
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-6w2r-r2m5-xq5w 7.1

Django is subject to SQL injection through its column aliases

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
GHSA-6w2r-r2m5-xq5w
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVOESA-2025-2231 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2231
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-2234 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2234
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-2235 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2235
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-2236 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2236
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-2237 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2237
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-2354 7.1

python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().(CVE-2025-57833)

Record
OESA-2025-2354
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2025-105 8.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
PYSEC-2025-105
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:16403 7.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record
RHSA-2025:16403
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:16487 7.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2025:16487
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:17498 7.1

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-django) security update

Record
RHSA-2025:17498
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:17499 7.1

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-django20) security update

Record
RHSA-2025:17499
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:17500 7.1

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-django) security update

Record
RHSA-2025:17500
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:17606 7.5

Red Hat Security Advisory: Satellite 6.17.5 Async Update

Record
RHSA-2025:17606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:17613 7.5

Red Hat Security Advisory: Satellite 6.16.5.4 Async Update

Record
RHSA-2025:17613
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:17614 7.5

Red Hat Security Advisory: Satellite 6.15.5.5 Async Update

Record
RHSA-2025:17614
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-57833 7.1

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
UBUNTU-CVE-2025-57833
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-django-2025-57833 No score

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Record
BIT-django-2025-57833
Updated
2026-11-02
OSVCLSA-2025-1759882283 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post1+tuxcare.

Record
CLSA-2025-1759882283
Updated
2026-11-02
OSVCLSA-2026-1787142559 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post3+tuxcare.

Record
CLSA-2026-1787142559
Updated
2026-11-02
OSVCLSA-2026-1788437106 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post5+tuxcare.

Record
CLSA-2026-1788437106
Updated
2026-11-02
OSVCLSA-2026-1788862060 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.10.post4+tuxcare.

Record
CLSA-2026-1788862060
Updated
2026-11-02
OSVCLSA-2026-1788934711 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post6+tuxcare.

Record
CLSA-2026-1788934711
Updated
2026-11-02
OSVCLSA-2026-1789117629 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post12+tuxcare.

Record
CLSA-2026-1789117629
Updated
2026-11-02
OSVCLSA-2026-1789455474 No score

TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post12+tuxcare.

Record
CLSA-2026-1789455474
Updated
2026-11-02
OSVCLSA-2026-1789475134 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post9+tuxcare.

Record
CLSA-2026-1789475134
Updated
2026-11-02
OSVCLSA-2026-1790339542 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post21+tuxcare.

Record
CLSA-2026-1790339542
Updated
2026-11-02
OSVCLSA-2026-1790830085 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.2.post10+tuxcare.

Record
CLSA-2026-1790830085
Updated
2026-11-02
OSVCLSA-2026-1790830102 No score

TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post11+tuxcare.

Record
CLSA-2026-1790830102
Updated
2026-11-02
OSVMGASA-2025-0229 No score

Updated python-django packages fix security vulnerability

Potential SQL injection in FilteredRelation column aliases. (CVE-2025-57833)

Record
MGASA-2025-0229
Updated
2026-11-02
OSVopenSUSE-SU-2025:15527-1 No score

python311-Django-5.2.6-1.1 on GA media

These are all security issues fixed in the python311-Django-5.2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15527-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15528-1 No score

python311-Django4-4.2.24-1.1 on GA media

These are all security issues fixed in the python311-Django4-4.2.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15528-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10005-1 No score

python312-Django6-6.0-1.1 on GA media

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10005-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11270-1 No score

python313-Django5-5.2.16-1.1 on GA media

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11270-1
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-57833 No score

CVE-2025-57833 in django - Patched by Root

Root has patched CVE-2025-57833 in the django package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-57833
Updated
2026-11-02
OSVSUSE-SU-2025:03074-1 No score

Security update for python-Django

This update for python-Django fixes the following issues:

  • CVE-2025-57833: Fixed potential SQL injection in FilteredRelation column aliases (bsc#1248810)
Record
SUSE-SU-2025:03074-1
Updated
2026-11-02
OSVUSN-7736-1 No score

python-django vulnerability

It was discovered that Django incorrectly handled certain inputs. An attacker could possibly use this issue to perform a SQL injection.

Record
USN-7736-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 before 4.2.24
4.2.24
django
PyPI
 5.0a1 up to 5.1.12
5.1.12
django
PyPI
 5.2a1 up to 5.2.6
5.2.6
py3-django
Alpine:v3.22
 before 4.2.24-r0
4.2.24-r0
py3-django
Alpine:v3.23
 before 4.2.24-r0
4.2.24-r0
py3-django
Alpine:v3.24
 before 4.2.24-r0
4.2.24-r0
django
Bitnami
 before 4.2.24, 5.0.0 up to 5.1.12, 5.2.0 up to 5.2.6
4.2.245.1.125.2.6
django
TuxCare:PyPI
 3.2.25 up to 3.2.25.post3+tuxcare, plus listed versions
3.2.25.post1+tuxcare3.2.25.post2+tuxcare
3.2.25.post3+tuxcare
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 5.1.9 up to 5.1.9.post5+tuxcare, plus listed versions
5.1.9.post1+tuxcare5.1.9.post2+tuxcare5.1.9.post3+tuxcare5.1.9.post4+tuxcare
5.1.9.post5+tuxcare
django
TuxCare:PyPI
 5.1.10 up to 5.1.10.post4+tuxcare, plus listed versions
5.1.10.post1+tuxcare5.1.10.post2+tuxcare5.1.10.post3+tuxcare
5.1.10.post4+tuxcare
Show 99 moreShow less
Affected packages
PackageAffectedFixed
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 5.1.4 up to 5.1.4.post6+tuxcare, plus listed versions
5.1.4.post1+tuxcare5.1.4.post2+tuxcare5.1.4.post3+tuxcare5.1.4.post4+tuxcare5.1.4.post5+tuxcare
5.1.4.post6+tuxcare
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 4.2 up to 4.2.post12+tuxcare, plus listed versions
4.2.post1+tuxcare4.2.post10+tuxcare4.2.post11+tuxcare4.2.post2+tuxcare4.2.post3+tuxcare
Show 6 moreShow less
4.2.post4+tuxcare4.2.post5+tuxcare4.2.post6+tuxcare4.2.post7+tuxcare4.2.post8+tuxcare4.2.post9+tuxcare
4.2.post12+tuxcare
django
TuxCare:PyPI
From an advisory covering 2 CVEs
 5.0 up to 5.0.post12+tuxcare, plus listed versions
5.0.post1+tuxcare5.0.post10+tuxcare5.0.post11+tuxcare5.0.post2+tuxcare5.0.post3+tuxcare
Show 6 moreShow less
5.0.post4+tuxcare5.0.post5+tuxcare5.0.post6+tuxcare5.0.post7+tuxcare5.0.post8+tuxcare5.0.post9+tuxcare
5.0.post12+tuxcare
django
TuxCare:PyPI
 5.1 up to 5.1.post9+tuxcare, plus listed versions
5.1.post1+tuxcare5.1.post2+tuxcare5.1.post3+tuxcare5.1.post4+tuxcare5.1.post5+tuxcare5.1.post6+tuxcare5.1.post7+tuxcare5.1.post8+tuxcare
5.1.post9+tuxcare
django
TuxCare:PyPI
 4.0 up to 4.0.post21+tuxcare, plus listed versions
4.0.post1+tuxcare4.0.post10+tuxcare4.0.post11+tuxcare4.0.post12+tuxcare4.0.post13+tuxcare
Show 15 moreShow less
4.0.post14+tuxcare4.0.post15+tuxcare4.0.post16+tuxcare4.0.post17+tuxcare4.0.post18+tuxcare4.0.post19+tuxcare4.0.post2+tuxcare4.0.post20+tuxcare4.0.post3+tuxcare4.0.post4+tuxcare4.0.post5+tuxcare4.0.post6+tuxcare4.0.post7+tuxcare4.0.post8+tuxcare4.0.post9+tuxcare
4.0.post21+tuxcare
django
TuxCare:PyPI
 5.0.2 up to 5.0.2.post10+tuxcare, plus listed versions
5.0.2.post1+tuxcare5.0.2.post2+tuxcare5.0.2.post3+tuxcare5.0.2.post4+tuxcare5.0.2.post5+tuxcare
Show 4 moreShow less
5.0.2.post6+tuxcare5.0.2.post7+tuxcare5.0.2.post8+tuxcare5.0.2.post9+tuxcare
5.0.2.post10+tuxcare
django
TuxCare:PyPI
 5.0.1 up to 5.0.1.post11+tuxcare, plus listed versions
5.0.1.post1+tuxcare5.0.1.post10+tuxcare5.0.1.post2+tuxcare5.0.1.post3+tuxcare5.0.1.post4+tuxcare
Show 5 moreShow less
5.0.1.post5+tuxcare5.0.1.post6+tuxcare5.0.1.post7+tuxcare5.0.1.post8+tuxcare5.0.1.post9+tuxcare
5.0.1.post11+tuxcare
python-django
Debian:12
 before 3:3.2.25-0+deb12u1, plus listed versions
3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1
3:3.2.25-0+deb12u1
python-django
Debian:13
 before 3:4.2.27-0+deb13u1, plus listed versions
3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1
3:4.2.27-0+deb13u1
python-django
Debian:14
 before 3:4.2.24-1, plus listed versions
3:4.2.23-1
3:4.2.24-1
python-django
Debian:11
 before 2:2.2.28-1~deb11u8, plus listed versions
2:2.2.24-12:2.2.25-1~deb11u12:2.2.26-1~deb11u12:2.2.28-1~deb11u12:2.2.28-1~deb11u2
Show 5 moreShow less
2:2.2.28-1~deb11u32:2.2.28-1~deb11u42:2.2.28-1~deb11u52:2.2.28-1~deb11u62:2.2.28-1~deb11u7
2:2.2.28-1~deb11u8
python-django
Debian:13
From an advisory covering 6 CVEs
 before 3:4.2.27-0+deb13u1, plus listed versions
3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1
3:4.2.27-0+deb13u1
python-django
Debian:12
From an advisory covering 23 CVEs
 before 3:3.2.25-0+deb12u1, plus listed versions
3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-13:3.2.20-1.13:3.2.21-1
3:3.2.25-0+deb12u1
django
PyPI
 before 4.2.24, plus listed versions
1.0.11.0.21.0.31.0.41.1
Show 45 moreShow less
1.1.11.1.21.1.31.1.41.101.10.11.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10a11.10b11.10rc11.111.11.11.11.101.11.111.11.121.11.131.11.141.11.151.11.161.11.171.11.181.11.21.11.201.11.211.11.221.11.231.11.241.11.251.11.261.11.271.11.281.11.291.11.31.11.41.11.51.11.61.11.71.11.81.11.9
4.2.24
django
PyPI
 5.0a1 up to 5.1.12, plus listed versions
5.05.0.15.0.105.0.115.0.12
Show 27 moreShow less
5.0.135.0.145.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.0b15.0rc15.15.1.15.1.105.1.115.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.1a15.1b15.1rc1
5.1.12
django
PyPI
 5.2a1 up to 5.2.6, plus listed versions
5.25.2.15.2.25.2.35.2.45.2.55.2b15.2rc1
5.2.6
python-django
Mageia:9
 before 4.1.13-1.6.mga9
4.1.13-1.6.mga9
python-django
openEuler:22.03-LTS-SP4
 before 4.2.15-8.oe2203sp4
4.2.15-8.oe2203sp4
python-django
openEuler:24.03-LTS
 before 4.2.15-8.oe2403
4.2.15-8.oe2403
python-django
openEuler:24.03-LTS-SP1
 before 4.2.15-8.oe2403sp1
4.2.15-8.oe2403sp1
python-django
openEuler:24.03-LTS-SP2
 before 4.2.15-8.oe2403sp2
4.2.15-8.oe2403sp2
python-django
openEuler:22.03-LTS-SP3
 before 4.2.15-8.oe2203sp3
4.2.15-8.oe2203sp3
python-django
openEuler:20.03-LTS-SP4
 before 2.2.27-18.oe2003sp4
2.2.27-18.oe2003sp4
django
PyPI
 4.2 up to 4.2.24, 5.1 up to 5.1.12, 5.2 up to 5.2.6, plus listed versions
4.2.14.2.104.2.114.2.124.2.13
Show 34 moreShow less
4.2.144.2.154.2.164.2.174.2.184.2.194.2.24.2.204.2.214.2.224.2.234.2.34.2.44.2.54.2.64.2.74.2.84.2.95.1.15.1.105.1.115.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.15.2.25.2.35.2.45.2.5
4.2.245.1.125.2.6
python39-django
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.2.24-1.el8ap
0:4.2.24-1.el8ap
python3x-django
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.2.24-1.el8ap
0:4.2.24-1.el8ap
python-django
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.2.24-1.el9ap
0:4.2.24-1.el9ap
python3-django
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.2.24-1.el9ap
0:4.2.24-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 2 CVEs
 before 0:4.6.20-1.el8ap
0:4.6.20-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 2 CVEs
 before 0:4.6.20-1.el9ap
0:4.6.20-1.el9ap
python3.11-django
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 2 CVEs
 before 0:4.2.24-1.el8ap
0:4.2.24-1.el8ap
python3.11-django
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 2 CVEs
 before 0:4.2.24-1.el8ap
0:4.2.24-1.el8ap
python3.11-django
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 2 CVEs
 before 0:4.2.24-1.el9ap
0:4.2.24-1.el9ap
python3.11-django
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 2 CVEs
 before 0:4.2.24-1.el9ap
0:4.2.24-1.el9ap
python-django
Red Hat:openstack:17.1::el9
 before 0:2.2.24-12.el9ost
0:2.2.24-12.el9ost
python3-django
Red Hat:openstack:17.1::el9
 before 0:2.2.24-12.el9ost
0:2.2.24-12.el9ost
python-django20
Red Hat:openstack:16.2::el8
 before 0:2.0.13-20.el8ost
0:2.0.13-20.el8ost
python3-django20
Red Hat:openstack:16.2::el8
 before 0:2.0.13-20.el8ost
0:2.0.13-20.el8ost
python-django
Red Hat:openstack:18.0::el9
 before 0:3.2.12-9.el9ost
0:3.2.12-9.el9ost
python3-django
Red Hat:openstack:18.0::el9
 before 0:3.2.12-9.el9ost
0:3.2.12-9.el9ost
puppet-agent
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
puppet-agent
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
cjson
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
python-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python-django
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
puppet-agent
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el8sat
0:8.8.1-3.el8sat
puppet-agent
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el8sat
0:8.8.1-3.el8sat
puppet-agent
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
puppet-agent
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
cjson
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
python-django
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python-django
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python-django
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python-django
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
puppet-agent
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:7.34.0-4.el8sat
0:7.34.0-4.el8sat
puppet-agent
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:7.34.0-4.el8sat
0:7.34.0-4.el8sat
cjson
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
python-django
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python-django
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
django
Root:PyPI
 before 4.1.13+aikido.2
4.1.13+aikido.23.2.25+aikido.14.1.13+aikido.32.2.28+aikido.23.2.25+aikido.22.2.28+aikido.33.2.25+aikido.34.1.13+aikido.42.2.28+aikido.44.1.13+aikido.52.2.28+aikido.53.2.25+aikido.4
python-Django
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 4.2.11-150600.3.30.1
4.2.11-150600.3.30.1
python-Django
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 4.2.11-150600.3.30.1
4.2.11-150600.3.30.1
python-Django
openSUSE:Leap 15.6
 before 4.2.11-150600.3.30.1
4.2.11-150600.3.30.1
python-django
Ubuntu:Pro:20.04:LTS
 before 2:2.2.12-1ubuntu0.29+esm3, plus listed versions
1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1
Show 33 moreShow less
2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.272:2.2.12-1ubuntu0.282:2.2.12-1ubuntu0.292:2.2.12-1ubuntu0.29+esm12:2.2.12-1ubuntu0.29+esm2
2:2.2.12-1ubuntu0.29+esm3
python-django
Ubuntu:22.04:LTS
 before 2:3.2.12-2ubuntu1.21, plus listed versions
2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2
Show 18 moreShow less
2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.162:3.2.12-2ubuntu1.172:3.2.12-2ubuntu1.182:3.2.12-2ubuntu1.192:3.2.12-2ubuntu1.20
2:3.2.12-2ubuntu1.21
python-django
Ubuntu:24.04:LTS
 before 3:4.2.11-1ubuntu1.10, plus listed versions
3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1
Show 9 moreShow less
3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.53:4.2.11-1ubuntu1.63:4.2.11-1ubuntu1.73:4.2.11-1ubuntu1.83:4.2.11-1ubuntu1.9
3:4.2.11-1ubuntu1.10
python-Django
openSUSE:Tumbleweed
 before 5.2.6-1.1
5.2.6-1.1
python-Django4
openSUSE:Tumbleweed
 before 4.2.24-1.1
4.2.24-1.1
python-Django6
openSUSE:Tumbleweed
From an advisory covering 70 CVEs
 before 6.0-1.1
6.0-1.1
python-Django5
openSUSE:Tumbleweed
From an advisory covering 93 CVEs
 before 5.2.16-1.1
5.2.16-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubMkway/CVE-2025-578332025-09-05
PoC in GitHubloic-houchi/Django-faille-CVE-2025-57833_test2025-09-09
PoC in GitHubianoboyle/CVE-2025-578332025-10-08
PoC in GitHubsw0rd1ight/CVE-2025-578332025-11-02
PoC in GitHubGayang2902/CVE-2025-578332025-11-27

History

History
RecordedChangedSources
affected, facts
affected, aliases, exploits, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-57833 is a high vulnerability (CVSS 7.1) in Djangoproject Django, published March 9, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.3%, the 98th percentile. Fixed in django 4.2.24.

References

Show 168 moreShow less
This page doesn't list everything

Left out here: 310 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open