CVE-2021-35042: djangoproject django
Vulnerability summary
CVE-2021-35042 is a critical (CVSS 9.8) vulnerability in djangoproject django. EPSS estimates a 44.37% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 44% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 02-07-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
44.37%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 44.37% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- py3-django< 3.1.13-r0
Djangoproject1 product
- django≥ 3.1, < 3.1.13 | ≥ 3.2, < 3.2.5
Fedoraproject1 product
- fedoraEOL34
PyPI1 product
- django≥ 3.2a1, < 3.2.5 | ≥ 3.0a1, < 3.1.13 | ≥ 3.2, < 3.2.5
4 vendors · 4 products
References
19 links- groups.google.com/forum/X Refsource MISC
- www.openwall.com/lists/oss-security/2021/07/02/2X Refsource CONFIRMWEBMailing ListPatchThird Party Advisory
- www.djangoproject.com/weblog/2021/jul/01/security-releases/X Refsource CONFIRMARTICLEPatchVendor Advisory
Show all 19 references
- github.com/django/djangoPACKAGE