SecBoard
Zurück zur CVE-Übersicht

CVE-2026-1207

MEDIUM(5.4)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Risk Signal Score17/100 — NIEDRIG
  • CVSS 5.4 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

12.8%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.4

Technische Schwere

Beschreibung

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

GitHub Advisories

GHSA-mwm9-4648-f68qHIGH

Django has an SQL Injection issue

pip/Django→ 6.0.2
GitHub Advisory

Referenzen