CVE-2021-35042

Published Jul 2, 2021·Updated Jun 16, 2026

NVD Description

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Public Exploits & PoCs4 found

PoC: CVE-2021-35042

SQL injection via unsanitized QuerySet.order_by() input

PoC: CVE-2021-35042

A basic analysis about CVE-2021-35942. SQL injection in Django.

PoC: CVE-2021-35042

Reproduce CVE-2021-35042

PoC: CVE-2021-35042

Django SQL injection vulnerability

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free