CVE-2022-28346

score

<0.1

cvss

9.8

epss

18.7%

published

2022-04-12

kev added

—

first seen

2026-10-21

Django 2.2 < 2.2.28, 3.2 < 3.2.13, and 4.0 < 4.0.4 contain a SQL injection caused by unsanitized column aliases in QuerySet.annotate(), aggregate(), and extra() methods via crafted dictionaries, letting attackers execute arbitrary SQL commands, exploit requires passing malicious **kwargs.