AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2022-28346

CRITICAL · CVSS 9.8 EPSS 18.66%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2022-04-12 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2022-28346
Severity
CRITICAL
CVSS
9.8
EPSS
18.66%

Original NVD Description

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.