Django, one of the most popular Python web development frameworks, has disclosed two critical security vulnerabilities that could allow attackers to execute SQL injection attacks and launch denial-of-service attacks.

The vulnerabilities, identified as CVE-2025-64458 and CVE-2025-64459, affect core components of the framework and require immediate attention from developers using Django in their applications.

The more serious of the two vulnerabilities, CVE-2025-64459, carries a high severity rating and involves a potential SQL injection weakness in Django’s QuerySet and Q objects.

SQL Injection and Windows-Specific DoS Vulnerability

Security researcher Cyberstan discovered that the QuerySet.The filter(), QuerySet.exclude(), and QuerySet.get() methods, along with the Q() class, are vulnerable when processing specially crafted dictionaries that use the _connector keyword argument with dictionary expansion.

This flaw could enable malicious actors to inject arbitrary SQL commands into database queries, potentially compromising sensitive data or gaining unauthorized access to backend systems.

SQL injection remains one of the most dangerous web application vulnerabilities, making this discovery particularly concerning for organizations relying on Django for their web infrastructure.

The second vulnerability, CVE-2025-64458, affects Django installations running on Windows.

Seokchan Yoon from ch4n3.KR identified this moderate-severity denial-of-service weakness in the HttpResponseRedirect and HttpResponsePermanentRedirect functions. The issue stems from slow NFKC normalization in Python on Windows.

Attackers can exploit this performance bottleneck by submitting inputs containing vast numbers of Unicode characters, causing the application to consume excessive resources and potentially become unresponsive.

Although rated moderate severity, this vulnerability could still disrupt services and affect user experience on Windows-based Django deployments.

Django developers should update their installations to the latest patched versions as soon as possible.

Organizations using Django on Windows systems should pay particular attention to the DoS vulnerability. At the same time, all Django users must address the SQL injection flaw regardless of their operating system.

Regular security updates and following Django’s security best practices remain essential for maintaining secure web applications.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Multiple Django Vulnerabilities Enable SQL injection and DoS Attack appeared first on Cyber Security News.

Cisco has confirmed that threat actors are actively exploiting a critical remote code execution (RCE) flaw in its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software.

First disclosed on September 25, 2025, the vulnerability tracked as CVE-2025-20333 poses a severe risk to organizations relying on these firewalls for VPN access. With a CVSS score of 9.9, it enables authenticated attackers to run arbitrary code with root privileges, potentially leading to full device compromise.

The issue stems from inadequate validation of user-supplied input in the VPN web server’s handling of HTTP(S) requests. An attacker armed with valid VPN credentials can craft malicious requests to trigger the flaw, bypassing normal safeguards and executing code that could exfiltrate data, install malware, or pivot deeper into networks.

Cisco’s advisory, updated November 5, 2025, reveals a new attack variant targeting unpatched systems, causing devices to reload unexpectedly and triggering denial-of-service (DoS) disruptions.

This escalation underscores the urgency, as real-world exploits have already surfaced in the wild, according to Cisco’s Event Response team.

Cisco ASA and FTD 0-day RCE Vulnerability

At its core, CVE-2025-20333 exploits a buffer overflow (CWE-120) in the webvpn component, active when certain remote access features are enabled.

For ASA software, vulnerable setups include AnyConnect IKEv2 with client services, Mobile User Security (MUS), or basic SSL VPN configurations via commands like “webvpn enable <interface>.”

FTD devices face similar risks through IKEv2 remote access or SSL VPN enabled in management interfaces like Cisco Secure Firewall Management Center.

Only devices with enabled SSL listen sockets for these features are exposed; Cisco Secure FMC Software remains unaffected.

Urgent Recommendations and Response

No workarounds exist, leaving upgrades as the sole defense. Cisco urges immediate patching to fixed releases listed in the advisory, such as ASA 9.18.4.19 or FTD 7.4.2.

Customers should audit configurations using “show running-config” to identify exposures and monitor for anomalous VPN traffic. The company links this to broader attacks on firewall platforms, advising layered defenses like multi-factor authentication and intrusion detection.

As cyber threats evolve, this incident highlights the perils of delayed updates in perimeter security. Organizations delaying action risk cascading breaches in an era of persistent exploitation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Cisco Warns of Hackers Actively Exploiting ASA and FTD 0-day RCE Vulnerability in the Wild appeared first on Cyber Security News.