CVE-2025-64459

CVE-2025-64459 is a critical SQL injection vulnerability affecting Django versions 5.1 prior to 5.1.14, 4.2 prior to 4.2.26, and 5.2 prior to 5.2.8, with older unsupported series also potentially vulnerable. This flaw allows attackers to inject malicious SQL queries through specially crafted dictionaries used with QuerySet methods and the Q() class. With a CVSS score of 9.1 (Critical), the vulnerability is easily exploitable over the network with no user interaction, leading to full compromise of confidentiality and integrity. While not yet listed in CISA's KEV catalog, an exploit (EDB-52456) is publicly available, and the vulnerability has garnered significant community discussion, indicating a high likelihood of active exploitation.