An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4425 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4425-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     December 29, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u10     CVE IDs        : CVE-2025-64459 CVE-2025-64460     Debian Bug     : 1121788

    It was discovered that there were two issues in Django, the     Python-based web development framework:

     * CVE-2025-64459: A potential SQL injection via _connector        keyword argument in QuerySet/Q objects. The methods QuerySet        filter(), exclude() and get() as well as the Q() class were        subject to SQL injection when using a suitably crafted dictionary        as the _connector argument.

     * CVE-2025-64460: A potential denial-of-service vulnerability in        XML serializer text extraction. An algorithmic complexity issue in        django.core.serializers.xml_serializer.getInnerText() allowed a        remote attacker to cause a potential denial-of-service triggering        CPU and memory exhaustion via a specially crafted XML input        submitted to a service that invokes XML Deserializer. The        vulnerability resulted from repeated string concatenation while        recursively collecting text nodes, which produced superlinear        computation.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u10.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-24dfd3b072 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b1379d950d advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword       argument (4.2.26)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (4.2.25)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column       aliases (4.2.24)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45ee190318 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20153-1 advisory.

    - CVE-2025-64459: Fixed a potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q`     objects (bsc#1252926)
    - CVE-2025-13372,CVE-2025-64460: Fixed Denial of Service in     'django.core.serializers.xml_serializer.getInnerText()' (bsc#1254437)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23069 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django SQL injection (CVE-2025-64459)
    * python3.11-django: Django SQL injection (CVE-2025-64459)
    * automation-eda-controller: Sensitive Internal Headers Disclosure in AAP EDA Event Streams     (CVE-2025-9908)
    * automation-eda-controller: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA (CVE-2025-9907)
    * automation-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration (CVE-2025-9909)
    * automation-gateway: Axios DoS via lack of data size check (CVE-2025-58754)
    * receptor: quic-go Crash Due to Premature HANDSHAKE_DONE Frame (CVE-2025-59530)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed using and condition with multiple attributes. Where previously the authentication map would skip     the missing attributes, with this fix the the map will be applied only if all attributes are present and     the condition(s) are met (AAP-53523)
    * Added UI changes to subscription management splash page (AAP-47864)
    * Fixed an issue where job templates did not remain editable after associated project was deleted     (AAP-58474)
    * automation-gateway has been updated to 2.5.20251210
    * python3.11-django-ansible-base has been updated to 2.5.20251210

    Automation Controller
    * Fixed an issue where jobs failed on fapolicyd enabled systems where python 3.9 was not installed by     default (AAP-58479)
    * Fixed an issue in receptor where some edge cases caused JSON to fail to parse (AAP-57253)
    * Fixed GitHub App Installation Access Token Lookup to accept Iv2 Client IDs (AAP-58882)
    * Updated controller to now use the force flag when syncing a project which has 'Allow branch override'     enabled (AAP-58532)
    * Fixed Redis broken pipe error in long-running jobs (AAP-59727)
    * Fixed column main_unifiedjobtemplate.org_unique does not exist migration error (AAP-56221)
    * ansible-runner has been updated to 2.4.2
    * automation-controller has been updated to 4.6.23
    * automation-controller-fapolicyd has been updated to 1.0-5
    * receptor has been updated to 1.6.2

    Automation Hub
    * Autocomplete attribute added to the Automation Hub API password field (AAP-59912)
    * automation-hub has been updated to 4.10.10
    * python3.11-galaxy-ng has been updated to 4.10.10
    * python3.11-galaxy-importer has been updated to 0.4.36

    Event-Driven Ansible
    * Added a credential type for mTLS event stream (AAP-55786)
    * Fixed an issue where redis_tls does not support boolean values such as yes/no (AAP-52828)
    * automation-eda-controller has been updated to 1.1.14

    Container-based Ansible Automation Platform
    * Fixed podman 5.6 compatibility with automation controller container configuration (AAP-58546)
    * Removed EVENT_STREAM_MTLS_BASE_URL from EDA settings file avoiding duplicate entry when using     eda_extra_settings variable (AAP-57587)
    * RHEL minimum version has been updated to 9.4 (AAP-56386)
    * nginx has been updated to 1.24 (AAP-56203)
    * Containerized installer setup has been updated to 2.5-21

    RPM-based Ansible Automation Platform
    * Fixed an issue where the installer failed during execution environment image upload when there is no     automation hub node in inventory (AAP-57122)
    * RHEL minimum version has been updated to 8.10 and 9.4 (AAP-56386)
    * nginx has been updated to 1.24 (AAP-56205)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-20

    Additional changes
    * ansible-builder has been updated to 3.1.1
    * ansible-creator has been updated to 25.12.0
    * ansible-dev-environment has been updated to 25.12.2
    * ansible-dev-tools has been updated to 25.12.0
    * ansible-lint has been updated to 25.12.0
    * ansible-navigator has been updated to 25.12.0
    * ansible-sign has been updated to 0.1.4
    * bindep has been updated to 2.13.0
    * molecule has been updated to 25.12.0
    * python3.11-ansible-compat has been updated to 25.12.0
    * python3.11-distlib has been updated to 0.4.0
    * python3.11-django has been updated to 4.2.26
    * python3.11-execnet has been updated to 2.1.2
    * python3.11-gunicorn has been updated to 23.0.0
    * python3.11-pluggy has been updated to 1.6.0
    * python3.11-pytest has been updated to 9.0.1
    * python3.11-pytest-ansible has been updated to 25.12.0
    * python3.11-pytest-xdist has been updated to 3.8.0
    * python3.11-ruamel-yaml-clib has been updated to 0.2.15
    * python3.11-subprocess-tee has been updated to 0.4.2
    * python3.11-tox-ansible has been updated to 25.12.0
    * python3.11-typing-extensions has been updated to 4.15.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23070 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django SQL injection (CVE-2025-64459)
    * python3.11-django: Django SQL injection (CVE-2025-64459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * IPv6 and IPv4/IPv6 dual stack support is now enabled by default (AAP-58923)
    * Fixed a server error that could happen assigning permissions via the /api/eda/ or /api/controller/     endpoints (AAP-58622)
    * automation-gateway has been updated to 2.6.20251210
    * python3.11-django-ansible-base has been updated to 2.6.20251210

    Automation Platform UI
    * Fixed an issue where the job template did not remain editable after the associated project was deleted     (AAP-58467)
    * Fixed a bug where project status update link on the job details page was broken (AAP-57215)
    * Fixed an issue where the brand logo was missing in the About page when accessing it from the Overview     page (AAP-57133)
    * Fixed an issue where the Resource Type filter in the Roles page did not correctly filter by resource     types (AAP-56691)
    * Fixed an issue where the Launched by field appeared blank in the UI when the project update is triggered     automatically (AAP-56643)
    * Updated playbook select dropdown to automatically select a playbook if there is only one in the project     (AAP-56279)
    * Fixed an issue where the source control Branch option was missing from the Inventory source (AAP-56149)
    * Authenticator label was updated from 'Azuread' to 'Azure AD' (AAP-55677)
    * Fixed a bug where the edit form for a survey would not display in the UI if the survey was created     without a default value using the ansible.controller collection (AAP-51548)
    * Improved labels and descriptions for Authenticator Mappings details (AAP-51295)
    * Fixed descriptions for Remotes and Remote Registries (AAP-49838)
    * Added Source control branch to Project Sync Job Details (AAP-49450)
    * Fixed an issue where the collection hyperlink was broken in card view in private automation hub     (AAP-49006)
    * Fixed an issue where the Search function failed to narrow results when adding host to group (AAP-47510)
    * Improved custom login text for legibility and to allow for HTML markup such as links (AAP-47462)
    * Fixed an issue where the filtering by host name did not work as expected in the Add Existing Host dialog     (AAP-45534)
    * Fixed url to workflow job template output from notifications (AAP-43796)
    * Search filter now works from any page within the Hosts list (AAP-42679)
    * Fixed an issue where creating a new template from Project or Inventory did not auto-populate the Project     field (AAP-41725)
    * Fixed an issue where the Permission Denied message on the templates tab, when the user has permission,     was misleading (AAP-40800)
    * Fixed an issue where the repository URL in the Details page was incorrect (AAP-40160)
    * Fixed a survey validation issue where the minimum length value of a question could be set to greater     than the maximum length value (AAP-39932)
    * Fixed a survey validation issue with text being treated as a number when evaluating its length     (AAP-39931)
    * Fixed an issue where the user was unable to create a schedule for Constructed inventory synchronization     (AAP-38660)
    * Fixed an issue with survey answers not being saved when editing or creating a schedule (AAP-37923)
    * Fixed a bug where instance groups on a schedule could not be edited (AAP-37872)
    * Introduced an Options section for the checkboxes Signed collections only and Sync all dependencies for     Automation hub (AAP-36592)
    * Added an info message about syncing dependencies outside the repository for Automation hub (AAP-36592)
    * Fixed an issue where there was an inconsistency in the task timestamps between the Overview and Detail     Views (AAP-36588)
    * Fixed an issue where the verify_ssl checkbox was not checked by default in the Create Credential form     (AAP-33889)
    * Updated formatting of large numbers in the extra vars field (AAP-31805)
    * automation-platform-ui has been updated to 2.6.4

    Automation controller
    * Added x-ai-description to controller schema to provide AI-friendly description for each endpoint     (AAP-59819)
    * Fixed Redis broken pipe error in long-running jobs (AAP-59728)
    * Fixed GitHub App Installation Access Token Lookup to accept Iv2 Client IDs (AAP-58880)
    * Updated controller to now use the force flag when syncing a project which has 'Allow branch override'     enabled (AAP-58533)
    * Bumped receptor collection to version 2.0.8, which is compatible with RHEL 10 (AAP-58421)
    * Updated various aspects of the OpenAPI Specification in support of MCP MVP (AAP-53640)
    * automation-controller has been updated to 4.7.6

    Automation hub
    * Autocomplete attribute was added to the Automation Hub API password field (AAP-59910)
    * Automation hub upgrades proceed when API access logging enabled (AAP-59886)
    * Fixed authentication failure for users with Team Admin role (AAP-58898)
    * automation-hub has been updated to 4.11.4
    * python3.11-galaxy-importer has been updated to 0.4.36
    * python3.11-galaxy-ng has been updated to 4.11.4

    Event-Driven Ansible
    * Added x-ai-description to EDA endpoints for AAP MCP Server consumption (AAP-58431)
    * automation-eda-controller has been updated to 1.2.3

    Container-based Ansible Automation Platform
    * Fixed an issue where after uninstall/re-install of receptor jobs were unable to start due to stale     exited containers with the same name were still present (AAP-59609)
    * Configure podman PID limits, sysctls for inotify and kernel keys, and ulimit nofile for user running AAP     service containers based on system resources (AAP-59438)
    * containerized installer setup has been updated to 2.6-4

    Additional changes
    * Ansible development tools is now available for RHEL 10
    * ansible-builder has been updated to 3.1.1
    * ansible-creator has been updated to 25.12.0
    * ansible-dev-environment has been updated to 25.12.2
    * ansible-dev-tools has been updated to 25.12.0
    * ansible-lint has been updated to 25.12.0
    * ansible-navigator has been updated to 25.12.0
    * ansible-sign has been updated to 0.1.4
    * bindep has been updated to 2.13.0
    * molecule has been updated to 25.12.0
    * python3.11-ansible-compat has been updated to 25.12.0
    * python3.11-distlib has been updated to 0.4.0
    * python3.11-django has been updated to 4.2.26
    * python3.11-execnet has been updated to 2.1.2
    * python3.11-gunicorn has been updated to 23.0.0
    * python3.11-pluggy has been updated to 1.6.0
    * python3.11-pytest has been updated to 9.0.1
    * python3.11-pytest-ansible has been updated to 25.12.0
    * python3.11-pytest-xdist has been updated to 3.8.0
    * python3.11-ruamel-yaml-clib has been updated to 0.2.15
    * python3.11-subprocess-tee has been updated to 0.4.2
    * python3.11-tox-ansible has been updated to 25.12.0
    * python3.11-typing-extensions has been updated to 4.15.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4100-1 advisory.

    - CVE-2025-64459: Fixed a potential SQL injection via the '_connector' keyword (bsc#1252926)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7859-1 advisory.

    It was discovered that Django incorrectly handled certain characters in queries. An attacker could     possibly use this issue to execute arbitrary SQL commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods     `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL     injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector`     argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may     also be affected. Django would like to thank cyberstan for reporting this issue. (CVE-2025-64459)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
280137	Debian dla-4425 : python-django-doc - security update	Nessus	Debian Local Security Checks	medium
279045	Fedora 43 : python-django5 (2025-24dfd3b072)	Nessus	Fedora Local Security Checks	medium
279042	Fedora 42 : python-django4.2 (2025-b1379d950d)	Nessus	Fedora Local Security Checks	medium
279041	Fedora 42 : python-django5 (2025-45ee190318)	Nessus	Fedora Local Security Checks	medium
278603	openSUSE 16 Security Update : python-Django (openSUSE-SU-2025-20153-1)	Nessus	SuSE Local Security Checks	medium
278146	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:23069)	Nessus	Red Hat Local Security Checks	critical
278140	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2025:23070)	Nessus	Red Hat Local Security Checks	critical
275492	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:4100-1)	Nessus	SuSE Local Security Checks	critical
274387	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Django vulnerabilities (USN-7859-1)	Nessus	Ubuntu Local Security Checks	critical
274081	Linux Distros Unpatched Vulnerability : CVE-2025-64459	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-64459

critical

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

critical

critical

critical