CVE-2022-28347

score

<0.1

cvss

9.8

epss

2.9%

published

2022-04-12

kev added

—

first seen

2026-10-21

Django 2.2 < 2.2.28, 3.2 < 3.2.13, and 4.0 < 4.0.4 contain a sql_injection caused by passing a crafted dictionary as the options argument in QuerySet.explain(), letting attackers execute arbitrary SQL, exploit requires passing malicious option name.