Description

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Remediation

References

CVE-2021-35042

Related Vulnerabilities

WordPress Plugin TR Easy Google Analytics Cross-Site Scripting (1.0.0)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (2.5)

WordPress Plugin Custom Login Page Customizer-LoginPress Unspecified Vulnerability (1.1.15)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-1813)

Joomla CVE-2021-26031 Vulnerability (CVE-2021-26031)

Severity

Critical

Classification

CVE-2021-35042 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities