CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
- Published
- Nov 5, 2025
- Updated
- Feb 26, 2026
- Assigning CNA
- DSF
- Evidence observed
- Dec 3, 2025
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NModerate · next 30 days
- Percentile
- 97.3%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.
Sources
Vulnerability: SQL Injection via QuerySet and Q() keyword argument unpacking. CVE ID: CVE-2025-64459 Severity: Critical (CVSS 9.1) Affected Versions: Django 5.1 < 5.1.14, 4.2 < 4.2.26, and 5.2 < 5.2.8. Researcher: Cyberstan (University of Warwick)
- RedTeamBrasil-CVE-2025-64459Exploit
NEO-SQLi — exploit Django _connector SQL Injection (CVE-2025-64459) | canal RedTeam Brasil
A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter() parameter injection via dictionary expansion using Docker.
- Helpdesk-Telecom-CVE-2025-64459Research
Sets up a vulnerable Django web application and provides a PDF detailing exploitation of CVE-2025-64459 for security training and lab practice.
demo application showing off SQL Injection exploit in django 5.2.7
- CVE-2025-64459-hunterScanner
CVE-2025-64459-hunter
Exploit tool for CVE-2025-64459, targeting SQL injection vulnerabilities in Django applications. Enables automated testing and exploitation of database-backed web endpoints.
Intentionally vulnerable app for hands-on CVE-2025-64459 practice, enabling guided exploitation and vulnerability analysis in security training.
CTF challenge demonstrating Django ORM filter injection (CVE-2025-64459) with auth bypass and product filter bypass exploits, including deployment and flag retrieval.
Wafcontrol Security Team · multiple · Dec 3, 2025
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.