https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:48:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-03743 bdu:2021-03743 https://cve.radiocsirt.org/vuln/bdu:2021-03743 https://cve.radiocsirt.org/vuln/bit-django-2020-7471 <p><strong>Affected:</strong> Bitnami: django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> https://cve.radiocsirt.org/vuln/bit-django-2020-7471 https://cve.radiocsirt.org/vuln/cnvd-2020-04524 cnvd-2020-04524 https://cve.radiocsirt.org/vuln/cnvd-2020-04524 https://cve.radiocsirt.org/vuln/euvd-2026-37973 EUVD-2026-37973 https://cve.radiocsirt.org/vuln/euvd-2026-37973 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7471 <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-7471 https://cve.radiocsirt.org/vuln/ghsa-hmr4-m2h5-33qx <p><strong>Affected:</strong> PyPI: Django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> https://cve.radiocsirt.org/vuln/ghsa-hmr4-m2h5-33qx https://cve.radiocsirt.org/vuln/gsd-2020-7471 gsd-2020-7471 https://cve.radiocsirt.org/vuln/gsd-2020-7471 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11205-1 <p>python36-Django-3.2.7-2.3 on GA media</p> <p>python36-Django-3.2.7-2.3 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:11205-1 https://cve.radiocsirt.org/vuln/pysec-2020-35 <p><strong>Affected:</strong> PyPI: django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> https://cve.radiocsirt.org/vuln/pysec-2020-35 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-7471 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-django</p> <p>Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-7471