About SQL Injection – Django (CVE-2025-64459) vulnerability. Django is a free and open-source high-level Python web framework. The vulnerability allows attackers to manipulate database query logic by injecting internal query parameters (_connector and _negated) when applications pass user-controlled input directly into filter(), exclude(), or get() calls. Exploiting this SQL injection may lead to unauthorized access to data, authentication bypass, or privilege escalation.
⚙️ The vulnerability was patched in Django versions 5.2.8, 5.1.14, and 4.2.26, released on November 5, 2025. Earlier unsupported versions of Django (such as 5.0.x, 4.1.x, and 3.2.x) were not tested and may be vulnerable.
🛠 A public exploit for the vulnerability appeared on November 6.
👾 No active exploitation has been reported so far.
🌐 According to 6sense, Django holds 32% of the web framework market share and is used by more than 42,000 companies. Ful.io tracks over 2.9 million websites running Django.
Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.
А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.