The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b1379d950d advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword       argument (4.2.26)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (4.2.25)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column       aliases (4.2.24)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45ee190318 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-24dfd3b072 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20153-1 advisory.

    - CVE-2025-64459: Fixed a potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q`     objects (bsc#1252926)
    - CVE-2025-13372,CVE-2025-64460: Fixed Denial of Service in     'django.core.serializers.xml_serializer.getInnerText()' (bsc#1254437)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.27, 5.1.x prior to 5.1.15, or 5.2.x prior to 5.2.9. It is, therefore, affected by multiple vulnearabilities as referenced by security release advisory:

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation`     is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary     expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.     Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected. Django would like to thank Stackered for reporting this issue. (CVE-2025-13372)

  - An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic     complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a     potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input     processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x)     were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this     issue. (CVE-2025-64460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006304 advisory.

    An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
    Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker     to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted     XML input processed by the XML `Deserializer`.
    Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be     affected.
    Django would like to thank Seokchan Yoon for reporting this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4425 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4425-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     December 29, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u10     CVE IDs        : CVE-2025-64459 CVE-2025-64460     Debian Bug     : 1121788

    It was discovered that there were two issues in Django, the     Python-based web development framework:

     * CVE-2025-64459: A potential SQL injection via _connector        keyword argument in QuerySet/Q objects. The methods QuerySet        filter(), exclude() and get() as well as the Q() class were        subject to SQL injection when using a suitably crafted dictionary        as the _connector argument.

     * CVE-2025-64460: A potential denial-of-service vulnerability in        XML serializer text extraction. An algorithmic complexity issue in        django.core.serializers.xml_serializer.getInnerText() allowed a        remote attacker to cause a potential denial-of-service triggering        CPU and memory exhaustion via a specially crafted XML input        submitted to a service that invokes XML Deserializer. The        vulnerability resulted from repeated string concatenation while        recursively collecting text nodes, which produced superlinear        computation.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u10.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7903-1 advisory.

    It was discovered that Django incorrectly handled certain characters in the FilteredRelation object. An     attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-13372)

    Seokchan Yoon discovered that Django inefficiently handled deserialization of XML objects. An attacker     could possibly use this issue to cause Django to use excessive resources, causing a denial of service.
    (CVE-2025-64460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4384-1 advisory.

    - CVE-2025-13372: Fixed SQL Injection in FilteredRelation (bsc#1254437)
    - CVE-2025-64460: Fixed denial of service via specially crafted XML input in       django.core.serializers.xml_serializer.getInnerText() (bsc#1254437)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6117 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6117-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     January 31, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-django     CVE ID         : CVE-2025-13372 CVE-2025-57833 CVE-2025-59681                      CVE-2025-59682 CVE-2025-64459 CVE-2025-64460

    Multiple security issues were found in Django, a Python web development     framework, which could result in SQL injection, directory traversal     or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 3:4.2.27-0+deb13u1.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6136 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6136-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     February 15, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-django     CVE ID         : CVE-2023-41164 CVE-2023-43665 CVE-2024-24680 CVE-2024-27351                      CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVE-2024-41989                      CVE-2024-41991 CVE-2024-42005 CVE-2024-45231 CVE-2024-53907                      CVE-2024-56374 CVE-2025-13372 CVE-2025-26699 CVE-2025-32873                      CVE-2025-48432 CVE-2025-57833 CVE-2025-59681 CVE-2025-59682                      CVE-2025-64459 CVE-2025-64460

    Multiple security issues were found in Django, a Python web development     framework, which could result in denial of service, information     disclosure, directory traversal or SQL injection.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3:3.2.25-0+deb12u1. python-django-storages also needed to be     updated to ensure ongoing compatibility (1.13.2-1+deb12u1).

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
279042	Fedora 42 : python-django4.2 (2025-b1379d950d)	Nessus	Fedora Local Security Checks	12/18/2025	12/18/2025	medium
279041	Fedora 42 : python-django5 (2025-45ee190318)	Nessus	Fedora Local Security Checks	12/18/2025	12/18/2025	medium
279045	Fedora 43 : python-django5 (2025-24dfd3b072)	Nessus	Fedora Local Security Checks	12/18/2025	12/18/2025	medium
278603	openSUSE 16 Security Update : python-Django (openSUSE-SU-2025-20153-1)	Nessus	SuSE Local Security Checks	12/13/2025	12/13/2025	medium
277467	Python Library Django 4.2.x < 4.2.27 / 5.1.x < 5.1.15 / 5.2.x < 5.2.9 Multiple Vulnerabilities	Nessus	Misc.	12/4/2025	3/3/2026	medium
303818	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-006304)	Nessus	Unity Linux Local Security Checks	3/26/2026	3/26/2026	medium
280137	Debian dla-4425 : python-django-doc - security update	Nessus	Debian Local Security Checks	12/30/2025	12/30/2025	medium
277365	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Django vulnerabilities (USN-7903-1)	Nessus	Ubuntu Local Security Checks	12/4/2025	3/3/2026	medium
278598	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:4384-1)	Nessus	SuSE Local Security Checks	12/13/2025	12/13/2025	medium
297437	Debian dsa-6117 : python-django-doc - security update	Nessus	Debian Local Security Checks	1/31/2026	1/31/2026	medium
299143	Debian dsa-6136 : python-django-doc - security update	Nessus	Debian Local Security Checks	2/15/2026	2/15/2026	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical