Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/weblate@5.9.dev0
Typepypi
Namespace
Nameweblate
Version5.9.dev0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.16.0
Latest_non_vulnerable_version5.17
Affected_by_vulnerabilities
0
url VCID-t6ye-yfrj-mkbt
vulnerability_id VCID-t6ye-yfrj-mkbt
summary Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code repository URL contains GitHub credentials, the confidential PAT and username are shown in plaintext and get saved into browser history. Moreover, if the request URL is logged, the credentials are written to logs in plaintext. If using Weblate official Docker image, nginx logs the URL and the token in plaintext. This issue is patched in version 5.11.
references
0
reference_url https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.11
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.11
1
reference_url https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m67m-3p5g-cw9j
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/WeblateOrg/weblate/security/advisories/GHSA-m67m-3p5g-cw9j
fixed_packages
0
url pkg:pypi/weblate@5.11
purl pkg:pypi/weblate@5.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4qdu-uag1-2yag
1
vulnerability VCID-557t-6mjj-7kcr
2
vulnerability VCID-egrq-f6sp-3ke5
3
vulnerability VCID-fesz-pv5h-c3e2
4
vulnerability VCID-hdsr-3vyy-5bgh
5
vulnerability VCID-hvg1-yhgu-m7ca
6
vulnerability VCID-p2hq-a8xy-p3b9
7
vulnerability VCID-unw7-2g9j-x7b5
8
vulnerability VCID-xsga-gghy-e7f3
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/weblate@5.11
aliases CVE-2025-32021, PYSEC-2025-35
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t6ye-yfrj-mkbt
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/weblate@5.9.dev0