{
    "id": "CVE-2025-64459",
    "published": "2025-11-05 15:15:41",
    "last_modified": "2026-06-17 09:54:24",
    "cvss_score": "9.1",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "cwe": "CWE-89",
    "description": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.",
    "epss_score": "0.19396",
    "epss_percentile": "0.97273",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-09-27 18:17:52",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "djangoproject",
            "product": "django"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "52456",
            "title": "Django 5.1.13 - SQL Injection",
            "date": "2025-12-03",
            "url": "https://www.exploit-db.com/exploits/52456"
        }
    ],
    "refs_list": [
        "https://docs.djangoproject.com/en/dev/releases/security/",
        "https://groups.google.com/g/django-announce",
        "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/",
        "https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html"
    ]
}