CVE-2026-1207mediumexploração observadaCWE-89

CVE-2026-1207: falha de média gravidade em djangoproject Django

Potential SQL injection via raster lookups on PostGIS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Django+ Monitorar python-django

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

55Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 5.4epss 13%
da publicação à arma
Publicada no NVD3 de fev.
VulnCheck+23d
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
djangoproject · Django
CVEs relacionadas — djangoproject Django

No mesmo produto, das mais perigosas para as menos.

CVE-2025-57833HIGHCVE-2025-57833EPSS 28.3%CVE-2025-64459CRITICALPotential SQL injection via _connector keyword argument in QuerySet and Q objectsEPSS 19.3%CVE-2025-32873MEDIUMCVE-2025-32873EPSS 14.3%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.2%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2024-56374MEDIUMCVE-2024-56374EPSS 1.3%