Live › vulnerability › CVE-2025-64459
Go to dashboardDjango versions before 4.2.26, 5.1.14 and 5.2.8 let crafted dictionaries passed to QuerySet methods and the Q() class inject SQL. An attacker who can send such input to a vulnerable view can read or change database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC, 1h before NVD. All times on this page are UTC.
Applications running Django 4.2 before 4.2.26, 5.1 before 5.1.14 or 5.2 before 5.2.8 are affected. Exposure depends on whether untrusted input reaches QuerySet methods or Q() as a dictionary; sources do not detail which code paths are exploitable. Projects on patched releases can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| djangoproject django | vendor | >= 4.2, < 4.2.26 | 4.2.26 |
| djangoproject django | vendor | >= 5.1, < 5.1.14 | 5.1.14 |
| djangoproject django | vendor | >= 5.2, < 5.2.8 | 5.2.8 |
python -m django --version and compare against 4.2.26, 5.1.14 and 5.2.8.Q() built from request data, such as request.GET or request.POST dictionaries.4.2.26, 5.1.14 or 5.2.8, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-02-02 · Changelog
New updates and improvements at Cloudflare.
February 2, 2026
This week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.
Key Findings
Q() class.| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...30698ff3 | N/A | XWiki - Remote Code Execution - CVE:CVE-2025-24893 2 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...da8ba7e6 | N/A | Django SQLI - CVE:CVE-2025-64459 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...8d667511 | N/A | NoSQL, MongoDB - SQLi - Comparison - 2 | Block | Block | Rule metadata description refined. Detection unchanged. |
This page as .md · .json · in your agent: get_signal("CVE-2025-64459")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.