{"id":"CVE-2021-35042","aliases":["ALPINE-CVE-2021-35042","BIT-django-2021-35042","EUVD-2021-0061","GHSA-xpfp-f569-q3p2","MGASA-2021-0356","PYSEC-2021-109","openSUSE-SU-2024:11205-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11235-1","openSUSE-SU-2026:11248-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"SQL Injection in Django","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.44369,"percentile":0.9878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2021-07-02T09:54:11Z","modified":"2026-11-03T06:32:33Z","exploits":[{"source":"pocgithub","id":"YouGina/CVE-2021-35042","title":"YouGina/CVE-2021-35042","date":"2021-07-10","url":"https://github.com/YouGina/CVE-2021-35042"},{"source":"pocgithub","id":"mrlihd/CVE-2021-35042","title":"mrlihd/CVE-2021-35042","date":"2021-09-01","url":"https://github.com/mrlihd/CVE-2021-35042"},{"source":"pocgithub","id":"r4vi/CVE-2021-35042","title":"r4vi/CVE-2021-35042","date":"2021-09-24","url":"https://github.com/r4vi/CVE-2021-35042"},{"source":"pocgithub","id":"zer0qs/CVE-2021-35042","title":"zer0qs/CVE-2021-35042","date":"2022-04-25","url":"https://github.com/zer0qs/CVE-2021-35042"},{"source":"pocgithub","id":"LUUANHDUC/CVE-2021-35042","title":"LUUANHDUC/CVE-2021-35042","date":"2023-05-18","url":"https://github.com/LUUANHDUC/CVE-2021-35042"},{"source":"pocgithub","id":"vutiendat323/INT14107_CVE-2021-35042","title":"vutiendat323/INT14107_CVE-2021-35042","date":"2026-04-17","url":"https://github.com/vutiendat323/INT14107_CVE-2021-35042"}],"fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["3.2.5","3.1.13"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["3.1.13-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["3.1.13","3.2.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2a1"},{"fixed":"3.2.5"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a1"},{"fixed":"3.1.13"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.1.13"},{"introduced":"3.2.0"},{"fixed":"3.2.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2a1"},{"fixed":"3.2.5"}]}],"versions":["3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2a1","3.2b1","3.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0a1"},{"fixed":"3.1.13"}]}],"versions":["3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.0a1","3.0b1","3.0rc1","3.1","3.1.1","3.1.10","3.1.11","3.1.12","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.1a1","3.1b1","3.1rc1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1"},{"fixed":"3.1.13"},{"introduced":"3.2"},{"fixed":"3.2.5"}]}],"versions":["3.1","3.1.1","3.1.10","3.1.11","3.1.12","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2","3.2.1","3.2.2","3.2.3","3.2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-2.3"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-2.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.14-1.1"}]}],"bundled":51},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-4.1"}]}],"bundled":59},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":49},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://groups.google.com/forum/#%21forum/django-announce","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://docs.djangoproject.com/en/3.2/releases/security/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://www.openwall.com/lists/oss-security/2021/07/02/2","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.djangoproject.com/weblog/2021/jul/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0008/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35042","tags":["web","advisory"]},{"url":"https://groups.google.com/forum/#!forum/django-announce","tags":["web"]},{"url":"https://github.com/django/django/commit/0bd57a879a0d54920bb9038a732645fb917040e9","tags":["web"]},{"url":"https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b11f81f","tags":["web"]},{"url":"https://github.com/django/django/commit/dae83a24519d6f284c74414e0b81d64d9b5a0db4","tags":["web"]},{"url":"https://docs.djangoproject.com/en/3.2/releases/security","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SS6NJTBYWOX6J7G4U3LUOILARJKWPQ5Y","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0008","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/jul/01/security-releases","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xpfp-f569-q3p2","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-109.yaml","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-35042","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0356.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28802","tags":["report"]},{"url":"https://www.djangoproject.com/weblog/2021/apr/06/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/may/04/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/may/06/security-releases/","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2021/jun/02/security-releases/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.8/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.9/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.10/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.11/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.12/","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/3.1.13/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2622","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4902-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4932-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4975-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-35042","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T09:54:11Z","modified":"2024-08-04T00:33:49.895Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-0061","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T09:54:11Z","modified":"2024-08-04T00:33:49Z","updated_at":"2026-11-03T03:24:31.533826Z"}],"ghsa":[{"id":"GHSA-xpfp-f569-q3p2","title":"SQL Injection in Django","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-09-22T17:34:49Z","modified":"2024-09-20T15:12:08Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-35042","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T10:15:07.653Z","modified":"2026-06-17T03:57:01.887Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"ALPINE-CVE-2021-35042","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T10:15:07.653Z","modified":"2026-11-03T06:32:33.609212014Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2021-35042","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T10:15:07.653Z","modified":"2026-10-24T10:30:25.92264093Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"GHSA-xpfp-f569-q3p2","title":"SQL Injection in Django","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-09-22T17:34:49Z","modified":"2025-02-21T05:30:56.014475Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"BIT-django-2021-35042","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2024-03-06T10:54:20.393Z","modified":"2026-09-08T08:46:26.608240638Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"MGASA-2021-0356","title":"Updated python-django package fixes security vulnerabilities","description":"In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,\nMultiPartParser allowed directory traversal via uploaded files with suitably\ncrafted file names. Built-in upload handlers were not affected by this\nvulnerability (CVE-2021-28658).\n\nIn Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1,\nMultiPartParser, UploadedFile, and FieldFile allowed directory traversal via\nuploaded files with suitably crafted file names (CVE-2021-31542).\n\nIn Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with\nPython 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the\nURLField form field is used). If an application uses values with newlines in\nan HTTP response, header injection can occur. Django itself is unaffected\nbecause HttpResponse prohibits newlines in HTTP headers (CVE-2021-32052).\n\nDjango before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential\ndirectory traversal via django.contrib.admindocs. Staff members could use the\nTemplateDetailView view to check the existence of arbitrary files.\nAdditionally, if (and only if) the default admindocs templates have been\ncustomized by application developers to also show file contents, then not only\nthe existence but also the file contents would have been exposed. In other\nwords, there is directory traversal outside of the template root directories\n(CVE-2021-33203).\n\nIn Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4,\nURLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit\nleading zero characters in octal literals. This may allow a bypass of access\ncontrol that is based on IP addresses. (validate_ipv4_address and\nvalidate_ipv46_address are unaffected with Python 3.9.5+..) (CVE-2021-33571).\n\nDjango 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by\nSQL injection if order_by is untrusted input from a client of a web application\n(CVE-2021-35042).\n\npython-django package is updated to 3.1.13 version to fix these security\nissues among other upstream bugfixes, see upstream release notes.\n","status":"published","published":"2021-07-16T08:25:31Z","modified":"2026-04-16T04:42:40.255404813Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11205-1","title":"python36-Django-3.2.7-2.3 on GA media","description":"These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:14.367485Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13887-1","title":"python310-Django-4.2.11-2.1 on GA media","description":"These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:27.577316Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14208-1","title":"python310-Django4-4.2.14-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-19T00:00:00Z","modified":"2026-02-04T02:20:42.476564Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11235-1","title":"python313-Django4-4.2.30-4.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-07-10T10:00:10.244458214Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11248-1","title":"python313-Django-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:07.179829219Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-109","description":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","status":"published","published":"2021-07-02T10:15:00Z","modified":"2023-12-06T01:01:17.903404Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}