About SQL Injection – Django (CVE-2025-64459) vulnerability. Django is a free and open-source high-level Python web framework. The vulnerability allows attackers to manipulate database query logic by injecting internal query parameters (_connector and _negated) when applications pass user-controlled input directly into filter(), exclude(), or get() calls. Exploiting this SQL injection may lead to unauthorized access to data, authentication bypass, or privilege escalation.
⚙️ The vulnerability was patched in Django versions 5.2.8, 5.1.14, and 4.2.26, released on November 5, 2025. Earlier unsupported versions of Django (such as 5.0.x, 4.1.x, and 3.2.x) were not tested and may be vulnerable.
🛠 A public exploit for the vulnerability appeared on November 6.
👾 No active exploitation has been reported so far.
🌐 According to 6sense, Django holds 32% of the web framework market share and is used by more than 42,000 companies. Ful.io tracks over 2.9 million websites running Django.
