Django vulnerabilities
The newest vulnerabilities affecting Django, up to 200. Subscribe by RSS.
- CVE-2026-114138Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationencode django-rest-framework · djangorestframework
- CVE-2026-114137Django REST framework: TokenProxy.delete() reports success and revokes nothingencode django-rest-framework · djangorestframework
- CVE-2026-114136Django REST framework: JSONParser applies an attacker-named codec to the request streamencode django-rest-framework · djangorestframework
- CVE-2026-87975Privilege abuse in model formsets with editable primary keysdjangoproject Django
- CVE-2026-87890Potential request forgery via spatial lookup byte valuesdjangoproject Django
- CVE-2026-84429Potential denial-of-service vulnerability in HTTP header parsingdjangoproject Django
- CVE-2026-77050Potential denial-of-service vulnerability in get_supported_language_variant()djangoproject Django
- CVE-2026-105392Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded keyLybbn Django-Vue-Lyadmin
- CVE-2026-105315django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injectiondjango-haystack
- CVE-2026-97764django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attackerdjango-allauth
- CVE-2026-93456django-page-cms through 2.0.13 CSRF via admin mutation viewsbatiste django-page-cms
- CVE-2026-93455django-page-cms through 2.0.13 Unauthorized Content Access via Staff Accountbatiste django-page-cms
- CVE-2026-90806DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorizationDjangoCRM django-crm
- CVE-2026-82835caoqianming django-vue-admin file access controlcaoqianming django-vue-admin
- CVE-2026-75526django CMS: Stored XSS in edit-mode plugin exception renderingdjango-cms
- CVE-2026-63003django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)django-cms
- CVE-2026-61663django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staffdjango-cms
- CVE-2026-54622django CMS: Clipboard copy IDOR discloses unauthorized plugin contentdjango-cms
- CVE-2026-54624django CMS: Structure endpoint bypasses page-view permissiondjango-cms
- CVE-2026-54623django CMS: Plugin move endpoint allows cyclic reparenting (DoS)django-cms
- CVE-2026-54625django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)django-cms
- CVE-2026-73531django-helpdesk < 2.3.3 Stored XSS via HTML Attachmentsdjango-helpdesk
- CVE-2026-73229Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requestsencode django-rest-framework · djangorestframework
- CVE-2026-73228Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`encode django-rest-framework · djangorestframework
- CVE-2026-71240DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url ParameterDjangoCRM django-crm
- CVE-2026-71239DjangoCRM - Server-Side Template Injection in Mass Mail Message RenderingDjangoCRM django-crm
- CVE-2026-71238DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token ForgeryDjangoCRM django-crm
- CVE-2026-18818Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorizationEhco1996 django-sspanel
- CVE-2026-15920Potential cross-site scripting via URLField values in the admindjangoproject Django
- CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collectionsdjangoproject Django · django
- CVE-2026-15337Potential denial-of-service vulnerability in check_for_language()djangoproject Django
- CVE-2026-15307Server-side file-write and request forgery via spatial lookupsdjangoproject Django · django
- CVE-2026-16216geex-arts django-jet OAuth cross-site request forgerygeex-arts django-jet
- CVE-2026-16215geex-arts django-jet OAuth Credential Revoke authorizationgeex-arts django-jet
- CVE-2026-16214geex-arts django-jet Dashboard views.py authorizationgeex-arts django-jet
- CVE-2026-16213Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storageFantomas42 django-blog-zinnia
- CVE-2026-16212awesto django-shop Purchase Stock inventory.py race conditionawesto django-shop
- CVE-2026-16208django-tastypie throttle.py CacheDBThrottle race conditiondjango-tastypie
- CVE-2026-16207django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query stringsdjango-tastypie
- CVE-2026-16206django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expirationdjango-oauth-toolkit
- CVE-2026-15188manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access controlmanjurulhoque django-job-portal
- CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in inputdjangoproject Django · django
- CVE-2026-53877Heap buffer over-read in GDALRasterdjangoproject Django · django
- CVE-2026-48588Potential exposure of private data via cached Set-Cookie responsedjangoproject Django · django
- CVE-2026-48587Potential exposure of private data via whitespace padding in Vary headerdjangoproject Django · django
- CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backenddjangoproject Django · django
- CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookiedjangoproject Django · django
- CVE-2026-42196django-s3file: Relative path traversalcodingjoe django-s3file · django-s3file
- CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTdjangoproject Django · django
- CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassdjangoproject Django · django
- CVE-2025-13030All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint.django-mdeditor
- CVE-2026-33034Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypassdjangoproject Django · django
- CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploaddjangoproject Django · django
- CVE-2026-4292Privilege abuse in ModelAdmin.list_editabledjangoproject Django · django
- CVE-2026-4277Privilege abuse in GenericInlineModelAdmindjangoproject Django · django
- CVE-2026-3902ASGI header spoofing via underscore/hyphen conflationdjangoproject Django · django
- CVE-2026-31815django-unicorn affected by component state manipulation via unvalidated attribute accessdjango-commons django-unicorn · django-unicorn
- CVE-2026-27982An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by django-allauth
- CVE-2026-25674Potential incorrect permissions on newly created file system objectsdjangoproject Django · django
- CVE-2026-25673Potential denial-of-service vulnerability in URLField via Unicode normalization on Windowsdjangoproject Django · django
- CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGIdjangoproject Django · djangoproject asgiref +1
- CVE-2026-1312Potential SQL injection via QuerySet.order_by and FilteredRelationdjangoproject Django · django
- CVE-2026-1287Potential SQL injection in column aliases via control charactersdjangoproject Django · django
- CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsdjangoproject Django · django
- CVE-2026-1207Potential SQL injection via raster lookups on PostGISdjangoproject Django · django
- CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handlerdjangoproject Django · django
- CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extractiondjangoproject Django · django
- CVE-2025-13372Potential SQL injection in FilteredRelation column aliases on PostgreSQLdjangoproject Django · django
- CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject Django · django
- CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windowsdjangoproject Django · django
- CVE-2025-59681An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject Django · django
- CVE-2025-59682An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject Django · django
- CVE-2025-57833An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.djangoproject Django · django
- CVE-2025-7738Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aapdjango-ansible-base · Red Hat Ansible Automation Platform 2…
- CVE-2025-48432An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23.djangoproject Django · django
- CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.django-helpdesk Project django-helpdesk · django-helpdesk
- CVE-2025-48383Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leakingcodingjoe django-select2 · django-select2
- CVE-2025-4894calmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryptioncalmkart Django-sso-server
- CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.djangoproject Django · django
- CVE-2025-27556An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14.djangoproject Django · django
- CVE-2025-26699An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.djangoproject Django · django
- CVE-2025-24370Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypassadamghill django-unicorn · django-unicorn
- CVE-2024-56374An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18.djangoproject Django · django
- CVE-2024-53907An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.django
- CVE-2024-53908An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.django
- CVE-2024-11406Stored XSS in django CMS Attributes Fieldsdjango CMS Association django CMS Attributes Fields · djang…
- CVE-2024-11404File Upload Bypass in django Filerdjango CMS Association django Filer · django-filer
- CVE-2024-11319Stored XSS in Open Source Project "django-cms"django CMS Association django-cms · django-cms
- CVE-2024-45230An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.django
- CVE-2024-45231An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16.django
- CVE-2024-41989An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-41990An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-41991An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-42005An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-38875An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7.django
- CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-39330An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-39614An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-28865django-wiki denial of service via regular expressiondjango-wiki · wiki
- CVE-2024-27351In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and thdjango
- CVE-2024-2319Cross-Site Scripting vulnerability in Django MarkdownXDjango MarkdownX · django-markdownx
- CVE-2024-24680An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.django
- CVE-2023-41164In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denidjango
- CVE-2023-43665In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when useddjango
- CVE-2023-46695An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.django
- CVE-2023-36053In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (reguladjango
- CVE-2023-33185Incorrect signature verification in django-sesdjango-ses
- CVE-2023-31047In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploadjango
- CVE-2017-20182Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scriptingMobile Vikings Django AJAX Utilities · django-ajax-utilities
- CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.django
- CVE-2023-23969In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avodjango
- CVE-2016-15010University of Cambridge django-ucamlookup Lookup cross site scriptingUniversity of Cambridge django-ucamlookup · django-ucamlook…
- CVE-2022-4595django-openipam exposed_hosts.html cross site scriptingdjango-openipam
- CVE-2022-4526django-photologue Default Template photo_detail.html cross site scriptingdjango-photologue
- CVE-2022-41323In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service atdjango
- CVE-2022-36359An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.django
- CVE-2022-34265An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.django
- CVE-2022-24840Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3filecodingjoe django-s3file · django-s3file
- CVE-2022-24857Multi factor authentication bypass in django-mfa3xi django-mfa3 · django-mfa3
- CVE-2022-28346An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.django
- CVE-2022-28347A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.django
- CVE-2022-22818The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current contedjango
- CVE-2022-23833An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.django
- CVE-2021-45115An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.django
- CVE-2021-45116An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.django
- CVE-2021-45452Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directdjango
- CVE-2021-44420In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream adjango
- CVE-2021-3994Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskdjango-helpdesk/django-helpdesk · django-helpdesk
- CVE-2021-25986Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications SectionDjango-wiki · wiki
- CVE-2021-3950Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskdjango-helpdesk/django-helpdesk · django-helpdesk
- CVE-2021-3945Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskdjango-helpdesk/django-helpdesk · django-helpdesk
- CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a wdjango
- CVE-2021-33203Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs.django
- CVE-2021-33571In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do notdjango
- CVE-2021-32052In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs django
- CVE-2021-31542In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversadjango
- CVE-2020-15225Denial of Service vulnerability in django-filtercarltongibson django-filter · django-filter
- CVE-2021-28658In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with sudjango
- CVE-2021-21416Potential sensitive information disclosed in error reportsubernostrum django-registration · django-registration
- CVE-2021-23336Web Cache Poisoningpython/cpython · django +3
- CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template"django
- CVE-2020-25626A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.Django REST Framework · djangorestframework
- CVE-2020-24584An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).django
- CVE-2020-24583An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).django
- CVE-2020-15105In Django Two-Factor Authentication, user passwords are stored in clear text in the Django sessionBouke django-two-factor-auth · django-two-factor-auth
- CVE-2020-4071Timing attack on django-basic-auth-ip-whitelisttm-kn django-basic-auth-ip-whitelist · django-basic-auth-ip…
- CVE-2020-13596An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.django
- CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.django
- CVE-2020-9402Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter django
- CVE-2020-7471Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter django
- CVE-2020-5224Session key exposure through session list in Django User SessionsJazzband django-user-sessions · django-user-sessions
- CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.django
- CVE-2019-19118Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing.django
- CVE-2019-14234An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-14235An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-14233An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-14232An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-12781An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3.django
- CVE-2019-12308An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2.django
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypjquery · jquery-rails +4
- CVE-2019-6975Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-sudjango
- CVE-2019-3498In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used django
- CVE-2018-16984An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts.django
- CVE-2018-14574django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.django
- CVE-2018-7537An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.django
- CVE-2018-7536An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19.django
- CVE-2018-6188django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentialldjango
- CVE-2017-12794In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 ddjango
- CVE-2017-7233Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on succesdjango
- CVE-2017-7234A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.sedjango
- CVE-2016-9013Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whedjango
- CVE-2016-9014Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to condjango
- CVE-2016-7401The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers django
- CVE-2016-6186Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjecdjango
- CVE-2016-2512The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary wedjango
- CVE-2016-2513The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users viadjango
- CVE-2016-2048Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions django
- CVE-2015-8213The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow redjango
- CVE-2015-5963contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other verdjango
- CVE-2015-5964The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x django
- CVE-2015-5143The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to caudjango
- CVE-2015-5144Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remdjango
- CVE-2015-5145validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified django
- CVE-2015-3982The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote atdjango
- CVE-2015-2316The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions ofdjango
- CVE-2015-2317The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does notdjango
- CVE-2015-2241Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remdjango
- CVE-2015-0219Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) cdjango
- CVE-2015-0220The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leaddjango
- CVE-2015-0221The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a timedjango
- CVE-2015-0222ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackdjango
- CVE-2014-0480The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 ddjango
- CVE-2014-0481The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 befordjango
- CVE-2014-0482The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before django
- CVE-2014-0483The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidadjango
- CVE-2014-1418Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cacdjango
- CVE-2014-3730The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not prodjango