CVE-2026-1207mediumexplotación observadaCWE-89

CVE-2026-1207: fallo de gravedad media en djangoproject Django

Potential SQL injection via raster lookups on PostGIS

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Django+ Monitorear python-django

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

55Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 5.4epss 13%
de la publicación al arma
Publicada en NVD3 feb
VulnCheck+23d
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
djangoproject · Django
CVEs relacionadas — djangoproject Django

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-57833HIGHCVE-2025-57833EPSS 28.3%CVE-2025-64459CRITICALPotential SQL injection via _connector keyword argument in QuerySet and Q objectsEPSS 19.3%CVE-2025-32873MEDIUMCVE-2025-32873EPSS 14.3%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.2%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2024-56374MEDIUMCVE-2024-56374EPSS 1.3%