Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| Django(PyPI) | 3.2a1 | 3.2.5 | N/A |
| Django(PyPI) | 3.0a1 | 3.1.13 | N/A |
CVSS Metrics
