CVE-2025-59681

score

<0.1

cvss

7.1

epss

0.6%

published

2025-10-01

kev added

—

first seen

2026-10-21

Django 4.2 < 4.2.25, 5.1 < 5.1.13, and 5.2 < 5.2.7 contain a SQL injection caused by improper sanitization of column aliases in QuerySet methods on MySQL and MariaDB, letting attackers execute arbitrary SQL commands, exploit requires crafted dictionary input.