CVE

CVE-2021-35042

9.8

CVSS

Description

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Attack Vector

Privileges Req.

User Interaction

Updated Oct 24, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-35042 Scanner

CVE-2021-35042 Scanner - SQL Injection vulnerability in Django

Used 2.4k times · 3.4k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →