Solomon Kebede

The `FilteredRelation` component is susceptible to SQL injection in column aliases through the use of control characters. This occurs when a crafted dictionary is used with dictionary expansion as the `**kwargs` passed to the `annotate()`, `aggregate()`, `extra()`, `values()`, `values list()`, and `alias()` methods of `QuerySet`.

The `.QuerySet.order by()` function is susceptible to SQL injection when column aliases contain periods, particularly when a crafted dictionary is used with dictionary expansion within a `FilteredRelation`. This can occur when the same alias is utilized. Earlier, unsupported Django series, including versions 5.0.x, 4.1.x, and 3.2.x, may also be affected.