Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

tendenci

5 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 4 medium
Registry
PyPI

Advisories 5

  • CVE-2025-70960Medium 5.4

    A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web…

    Affected: through 16.14; through 15.3.7.

  • CVE-2025-70959Medium 5.4

    A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web…

    Affected: through 15.3.7.

  • CVE-2020-36962Medium 5.3

    Tendenci 12.3.1 - CSV/ Formula Injection

    Affected: fixed in 12.3.2; through 12.3.1.

  • CVE-2026-23946Medium 6.8

    Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

    Affected: fixed in 15.3.12.

  • Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

    Affected: fixed in 12.0.11; fixed in 12.0.11.