CVE-2025-64459 — CVE & Security Advisory Radar

🎯 CVE-2025-64459 CRITICAL 9.1 🔥 EPSS 19.4% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2025-64459 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Klassifikation & Betroffenheit:

djangoproject Django 4.2 <4.2.26Django 5.2 <5.2.8Django 5.1 <5.1.14djangoproject django *

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 🎯 High

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used proper…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-7 · Blind SQL Injection (High) CAPEC-66 · SQL Injection (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-470 · Expanding Control over the Operating Sys… (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-4277 9.8 CVE-2026-15307 8.7

🧪 Exploit-Evidenz: EDB-52456 · Django 5.1.13 - SQL Injection

🐙 rockmelodies/django_sqli_target_ 🐙 nunpa/CVE-2025-64459 🐙 omarkurt/django-connector-CVE-20 🐙 0xCyberstan/CVE-2025-64459-Poc 🐙 Z3YR0xX/CVE-2025-64459

🩹 Patch verfügbar (OSV):

🩹 0dfd59e2d5c713510c6bcf245e8ac2d5b2043a0a (Commit) 🩹 da443c4d5472dfc5afe2567b59123da8372715fe (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2025

Veröffentlicht 11/2025

Heute 04.09.

CVSS-Vektor-Analyse: 9.1

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Veröffentlicht:05.11.2025

Aktualisiert:17.06.2026 09:54

Assigner (CNA):DSF

EUVD-ID:EUVD-2025-37763

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-04
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.1 CRITICAL

🇪🇺 EUVD

EPSS

19.4%

CVE-2025-64459 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

djangoproject

CVE-2025-64459 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

05.11.2025

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub