Search for packages
| purl | pkg:deb/debian/python-django@2:3.2.13-1?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-pa75-6avj-duf7 | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. |
BIT-django-2022-28346
CVE-2022-28346 GHSA-2gwj-7jmv-h26r PYSEC-2022-190 |
| VCID-th9v-dk98-3kea | A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name. |
BIT-django-2022-28347
CVE-2022-28347 GHSA-w24h-v9qh-8gxj PYSEC-2022-191 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-16T09:36:24.442027+00:00 | Debian Importer | Fixing | VCID-th9v-dk98-3kea | https://security-tracker.debian.org/tracker/data/json | 38.4.0 |
| 2026-04-16T09:21:49.493535+00:00 | Debian Importer | Fixing | VCID-pa75-6avj-duf7 | https://security-tracker.debian.org/tracker/data/json | 38.4.0 |
| 2026-04-12T18:15:34.508712+00:00 | Debian Importer | Fixing | VCID-th9v-dk98-3kea | https://security-tracker.debian.org/tracker/data/json | 38.3.0 |
| 2026-04-12T18:15:34.444660+00:00 | Debian Importer | Fixing | VCID-pa75-6avj-duf7 | https://security-tracker.debian.org/tracker/data/json | 38.3.0 |
| 2026-04-03T07:50:43.800801+00:00 | Debian Importer | Fixing | VCID-th9v-dk98-3kea | https://security-tracker.debian.org/tracker/data/json | 38.1.0 |
| 2026-04-03T07:50:43.743218+00:00 | Debian Importer | Fixing | VCID-pa75-6avj-duf7 | https://security-tracker.debian.org/tracker/data/json | 38.1.0 |