CVE-2022-34265

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

• CWE-89

• https://docs.djangoproject.com/en/4.0/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
• https://security.netapp.com/advisory/ntap-20220818-0006/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/jul/04/security-releases/Patch, Vendor Advisory
• https://docs.djangoproject.com/en/4.0/releases/security/Patch, Vendor Advisory
• https://groups.google.com/forum/#%21forum/django-announce
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
• https://security.netapp.com/advisory/ntap-20220818-0006/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5254Third Party Advisory
• https://www.djangoproject.com/weblog/2022/jul/04/security-releases/Patch, Vendor Advisory

Published

Jul 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3426The Advanced WP Columns WordPress plugin through 2.0.6 does …4.8
• CVE-2022-34260Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (…7.8
• CVE-2022-34261Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (…5.5
• CVE-2022-34262Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (…5.5
• CVE-2022-34263Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (…7.8
• CVE-2022-34264Adobe FrameMaker versions 2019 Update 8 (and earlier) and 20…5.5
• CVE-2022-34266The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon…5.5
• CVE-2022-34267An issue was discovered in RWS WorldServer before 11.7.3. Ad…9.8
• CVE-2022-34268An issue was discovered in RWS WorldServer before 11.7.3. /c…9.8
• CVE-2022-34269An issue was discovered in RWS WorldServer before 11.7.3. An…8.8
• CVE-2022-3427The Corner Ad plugin for WordPress is vulnerable to Cross-Si…6.5
• CVE-2022-34270An issue was discovered in RWS WorldServer before 11.7.3. Re…9.8