Search for packages
| purl | pkg:deb/debian/python-django@2:2.2.28-1~deb11u2?distro=trixie |
| Next non-vulnerable version | 2:2.2.28-1~deb11u3 |
| Latest non-vulnerable version | 3:4.2.30-1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1adz-zw3h-pqek
Aliases: CVE-2026-3902 GHSA-mvfq-ggxm-9mc5 |
Affected by 0 other vulnerabilities. |
|
|
VCID-46pv-pzsu-jucd
Aliases: CVE-2026-4292 GHSA-mmwr-2jhp-mc7j |
Affected by 0 other vulnerabilities. |
|
|
VCID-ac4c-321h-tqfk
Aliases: CVE-2026-25674 GHSA-mjgh-79qc-68w3 |
Django has a Race Condition vulnerability An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. |
Affected by 5 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ff2a-at5f-2qa8
Aliases: CVE-2026-33033 GHSA-5mf9-h53q-7mhq |
Affected by 0 other vulnerabilities. |
|
|
VCID-gfym-spzk-w7gk
Aliases: CVE-2026-4277 GHSA-pwjp-ccjc-ghwg |
Affected by 0 other vulnerabilities. |
|
|
VCID-jzae-1awh-k7cm
Aliases: BIT-django-2024-38875 CVE-2024-38875 GHSA-qg2p-9jwr-mmqf PYSEC-2024-56 |
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. |
Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-mga4-an1w-qqf9
Aliases: BIT-django-2024-45230 CVE-2024-45230 GHSA-5hgc-2vfp-mqvc PYSEC-2024-102 |
Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ssut-reka-r3f8
Aliases: CVE-2026-33034 GHSA-933h-hp56-hf7m |
Affected by 0 other vulnerabilities. |
|
|
VCID-xhpa-mffz-syfy
Aliases: BIT-django-2024-41990 CVE-2024-41990 GHSA-795c-9xpc-xw6g PYSEC-2024-68 |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1fs3-2msx-9kev | django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. |
CVE-2018-14574
GHSA-5hg3-6c2f-f3wr PYSEC-2018-2 |
| VCID-1pvd-3217-6ygv | The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. |
CVE-2012-3443
GHSA-59w8-4wm2-4xw8 PYSEC-2012-3 |
| VCID-1v22-g646-wbay | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences. |
CVE-2019-14235
GHSA-v9qg-3j8p-r63v PYSEC-2019-14 |
| VCID-27wt-wmzc-1bc2 | django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive. |
CVE-2018-6188
GHSA-rf4j-j272-fj86 PYSEC-2018-4 |
| VCID-28g3-ubx6-ebff | Django has Inefficient Algorithmic Complexity An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
CVE-2026-1285
GHSA-4rrr-2h4v-f3j9 |
| VCID-2dhb-9yue-33h7 | Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property. |
CVE-2015-2241
GHSA-6565-fg86-6jcx PYSEC-2015-8 |
| VCID-2m9f-3cgw-ekdr | The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users. |
CVE-2014-0473
GHSA-89hj-xfx5-7q66 PYSEC-2014-2 |
| VCID-2tfv-rtq7-2fg9 | Django has Observable Timing Discrepancy An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. |
CVE-2025-13473
GHSA-2mcm-79hx-8fxw |
| VCID-2zb9-27sm-3kgh | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
CVE-2019-14232
GHSA-c4qh-4vgv-qc6g PYSEC-2019-11 |
| VCID-325d-7dfk-sqd2 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests. |
CVE-2016-2513
GHSA-fp6p-5xvw-m74f PYSEC-2016-16 |
| VCID-3sac-ah8j-pucd | Django SQL injection in HasKey(lhs, rhs) on Oracle An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.) |
BIT-django-2024-53908
CVE-2024-53908 GHSA-m9g8-fxxm-xg86 PYSEC-2024-157 |
| VCID-42cm-j2av-87ea | The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. |
CVE-2014-0480
GHSA-f7cm-ccfp-3q4r PYSEC-2014-4 |
| VCID-42x9-8c3c-bug1 | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. |
BIT-django-2023-31047
CVE-2023-31047 GHSA-r3xc-prgr-mg9p PYSEC-2023-61 |
| VCID-438j-ce4y-zkan | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. |
CVE-2017-12794
GHSA-9r8w-6x8c-6jr9 PYSEC-2017-44 |
| VCID-47er-pm3z-qfh3 | Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload. |
CVE-2011-0697
GHSA-8m3r-rv5g-fcpq PYSEC-2011-11 |
| VCID-4ztz-fq98-5fh1 | In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. |
BIT-django-2023-41164
CVE-2023-41164 GHSA-7h4p-27mh-hmrw PYSEC-2023-225 |
| VCID-56na-n4w5-8fak | An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. |
CVE-2019-12308
GHSA-7rp2-fm2h-wchj PYSEC-2019-79 |
| VCID-5g4y-1qmy-27bd | ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries. |
CVE-2015-0222
GHSA-6g95-x6cj-mg4v PYSEC-2015-7 |
| VCID-66kq-hbhe-9ba3 | The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL. |
CVE-2009-2659
GHSA-9xg7-gg9m-rmq9 PYSEC-2009-3 |
| VCID-66w1-4zku-gyfp | Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. |
BIT-django-2021-45452
CVE-2021-45452 GHSA-jrh2-hc4r-7jwx PYSEC-2022-3 |
| VCID-6gss-ppm5-3yc9 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input. |
BIT-django-2022-36359
CVE-2022-36359 GHSA-8x94-hmjh-97hq PYSEC-2022-245 |
| VCID-6hfy-2gcp-1uh4 | An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes. |
CVE-2018-16984
GHSA-6mx3-3vqg-hpp2 PYSEC-2018-3 |
| VCID-72fp-zabh-6qbv | Django Improper Access Control The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user. |
CVE-2007-0405
GHSA-mwv2-398h-v489 |
| VCID-78r4-85ms-63hm | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. |
BIT-django-2023-46695
CVE-2023-46695 GHSA-qmf9-6jqf-j8fq PYSEC-2023-222 |
| VCID-7bu3-ckpj-gbf8 | The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. |
CVE-2012-3444
GHSA-5h2q-4hrp-v9rr PYSEC-2012-4 |
| VCID-7tca-pgcs-cuhd | In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression. |
BIT-django-2022-41323
CVE-2022-41323 GHSA-qrw5-5h28-6cmg PYSEC-2022-304 |
| VCID-7tph-k8q2-bue2 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. |
BIT-django-2024-41991
CVE-2024-41991 GHSA-r836-hh6v-rg5g PYSEC-2024-69 |
| VCID-84mm-45p6-xkau | Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
CVE-2025-64458
GHSA-qw25-v68c-qjf3 |
| VCID-896g-hqec-ryb9 | An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. |
BIT-django-2025-48432
CVE-2025-48432 GHSA-7xr5-9hcq-chf9 PYSEC-2025-47 |
| VCID-8b12-22bg-jkch | The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers. |
CVE-2007-5712
GHSA-9v8h-57gv-qch6 PYSEC-2007-1 |
| VCID-8jaq-53td-wbeg | Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) |
CVE-2019-19844
GHSA-vfq6-hq5r-27r6 PYSEC-2019-16 |
| VCID-8m4b-y4va-kqgm | In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. |
BIT-django-2023-43665
CVE-2023-43665 GHSA-h8gc-pgj2-vjm3 PYSEC-2023-226 |
| VCID-8qu1-45n9-gyb1 | Django has an SQL Injection issue An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. |
CVE-2026-1287
GHSA-gvg8-93h5-g6qq |
| VCID-8teq-9xr9-q3fg | The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. |
CVE-2016-7401
GHSA-crhm-qpjc-cm64 PYSEC-2016-3 |
| VCID-8xgs-8xjr-cber | An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. |
BIT-django-2024-24680
CVE-2024-24680 GHSA-xxj9-f6rv-m3x4 PYSEC-2024-28 |
| VCID-8yfq-hpqh-zqcp | XML External Entity (XXE) in Django The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack. |
CVE-2013-1665
GHSA-x64m-686f-fmm3 |
| VCID-9abh-apwm-ebab | An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags(). |
BIT-django-2025-32873
CVE-2025-32873 GHSA-8j24-cjrq-gr2m PYSEC-2025-37 |
| VCID-9k9t-vp1a-z7bt | In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. |
BIT-django-2021-3281
CVE-2021-3281 GHSA-fvgf-6h6h-3322 PYSEC-2021-9 |
| VCID-9uzd-mmyv-mfh4 | Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue. |
CVE-2025-64459
GHSA-frmv-pr5f-9mcr |
| VCID-a6d1-p4q6-fyav | Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447. |
CVE-2011-0696
GHSA-5j2h-h5hg-3wf8 PYSEC-2011-10 |
| VCID-a715-2qks-wyhn | The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. |
CVE-2015-5143
GHSA-h582-2pch-3xv3 PYSEC-2015-20 |
| VCID-a8zx-jamf-cfcm | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. |
CVE-2019-14234
GHSA-6r97-cj55-9hrq PYSEC-2019-13 |
| VCID-bdms-nb18-guf9 | Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. |
CVE-2017-7233
GHSA-37hp-765x-j95x PYSEC-2017-9 |
| VCID-bgjt-c6sa-pfaj | The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." |
CVE-2014-3730
GHSA-vq3h-3q7v-9prw PYSEC-2014-20 |
| VCID-bgmv-mf3x-bkew | The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file. |
CVE-2015-0221
GHSA-jhjg-w2cp-5j44 PYSEC-2015-6 |
| VCID-br5x-v7md-47hp | The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. |
CVE-2015-8213
GHSA-6wcr-wcqm-3mfh PYSEC-2015-11 |
| VCID-c1n5-4ars-u7ff | The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. |
CVE-2014-0481
GHSA-296w-6qhq-gf92 PYSEC-2014-5 |
| VCID-c2kc-1jh1-j3ha | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.) |
CVE-2019-19118
GHSA-hvmf-r92r-27hr PYSEC-2019-15 |
| VCID-c6xy-v4sf-u3hn | Django vulnerable to partial directory traversal via archives An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. |
CVE-2025-59682
GHSA-q95w-c7qg-hrff |
| VCID-c8s7-3g9m-d3cw | In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) . |
BIT-django-2021-33571
CVE-2021-33571 GHSA-p99v-5w3c-jqq9 PYSEC-2021-99 |
| VCID-cnnp-j1tv-7uhu | The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter. |
CVE-2013-0306
GHSA-g8xg-jgj6-49r3 PYSEC-2013-17 |
| VCID-czkz-mcv8-mqfc | The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. |
CVE-2012-3442
GHSA-78vx-ggch-wghm PYSEC-2012-2 |
| VCID-d7fu-jyta-2ygm | contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. |
CVE-2015-5963
GHSA-pgxh-wfw4-jx2v PYSEC-2015-22 |
| VCID-e2jd-yd4j-kqgt | Django allows enumeration of user e-mail addresses An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). |
CVE-2024-45231
GHSA-rrqc-c2jx-6jgv |
| VCID-e87q-1j8h-93hh | An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.) |
BIT-django-2024-56374
CVE-2024-56374 GHSA-qcgg-j2x8-h9g8 PYSEC-2025-1 |
| VCID-e9k9-1s9f-dbgv | Django has Inefficient Algorithmic Complexity An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue. |
CVE-2025-14550
GHSA-33mw-q7rj-mjwj |
| VCID-eker-m822-cuax | The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. |
CVE-2014-0483
GHSA-rw75-m7gp-92m3 PYSEC-2014-7 |
| VCID-erym-d91m-v7g9 | Django admin panel CSFR |
CVE-2007-5828
|
| VCID-fw2d-s2rt-syfz | Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays. |
CVE-2011-0698
GHSA-7g9h-c88w-r7h2 PYSEC-2011-12 |
| VCID-g56k-prrj-aqb1 | The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. |
CVE-2011-4140
GHSA-h95j-h2rv-qrg4 PYSEC-2011-5 |
| VCID-gan1-9gwu-63d2 | Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application. |
BIT-django-2021-35042
CVE-2021-35042 GHSA-xpfp-f569-q3p2 PYSEC-2021-109 |
| VCID-gp5e-nguh-5fdk | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files. |
BIT-django-2022-23833
CVE-2022-23833 GHSA-6cw3-g6wv-c2xv PYSEC-2022-20 |
| VCID-gvvs-megy-9fc3 | The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. |
CVE-2015-2316
GHSA-j3j3-jrfh-cm2w PYSEC-2015-18 |
| VCID-gwme-keqv-kkgr | The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme. |
CVE-2013-6044
GHSA-9cwg-mhxf-hh59 PYSEC-2013-21 |
| VCID-hk24-1yzs-ybhu | Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField. |
CVE-2013-4249
GHSA-4894-5vqc-6r2r PYSEC-2013-19 |
| VCID-hugz-zq5c-pugn | Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression. |
CVE-2009-3695
GHSA-p6m5-h7pp-v2x5 PYSEC-2009-4 |
| VCID-hwa2-n7a2-pyg1 | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key. |
BIT-django-2021-45116
CVE-2021-45116 GHSA-8c5j-9r9f-c6w8 PYSEC-2022-2 |
| VCID-j4br-4y39-s3gs | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. |
BIT-django-2020-13596
CVE-2020-13596 GHSA-2m34-jcjv-45xf PYSEC-2020-32 |
| VCID-jae8-w85w-cyfu | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
CVE-2018-7537
GHSA-2f9x-5v75-3qv4 PYSEC-2018-6 |
| VCID-jc9f-vgy8-ruan | The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header. |
CVE-2014-0482
GHSA-625g-gx8c-xcmg PYSEC-2014-6 |
| VCID-jh1e-72hp-fuf4 | In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665. |
BIT-django-2024-27351
CVE-2024-27351 GHSA-vm8q-m57g-pff3 PYSEC-2024-47 |
| VCID-jtru-9jmz-kkek | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. |
CVE-2019-14233
GHSA-h5jv-4p7w-64jg PYSEC-2019-12 |
| VCID-jumh-hkhx-7qc9 | The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. |
CVE-2015-2317
GHSA-7fq8-4pv5-5w5c PYSEC-2015-9 |
| VCID-k25u-g17y-hyfh | A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. |
CVE-2017-7234
GHSA-h4hv-m4h4-mhwg PYSEC-2017-10 |
| VCID-k6s1-gnmc-e3ed | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. |
CVE-2016-9014
GHSA-3f2c-jm6v-cr35 PYSEC-2016-18 |
| VCID-khxh-hjmn-fbdq | The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. |
CVE-2015-3982
GHSA-6wgp-fwfm-mxp3 PYSEC-2015-19 |
| VCID-kypj-ptb9-8qhz | In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. |
BIT-django-2021-31542
CVE-2021-31542 GHSA-rxjp-mfm9-w4wr PYSEC-2021-7 |
| VCID-m7dr-pjnv-hkb5 | The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values. |
CVE-2012-4520
GHSA-2655-q453-22f9 PYSEC-2012-7 |
| VCID-m91a-6235-nye9 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. |
BIT-django-2024-42005
CVE-2024-42005 GHSA-pv4p-cwwg-4rph PYSEC-2024-70 |
| VCID-mm3u-a8ar-b3hp | django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier. |
CVE-2011-4136
GHSA-x88j-93vc-wpmp PYSEC-2011-1 |
| VCID-mmay-juu6-5ua9 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077. |
BIT-django-2020-24584
CVE-2020-24584 GHSA-fr28-569j-53c4 PYSEC-2020-34 |
| VCID-msge-1mfu-7qfa | Django has an SQL Injection issue An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. |
CVE-2026-1312
GHSA-6426-9fv3-65x8 |
| VCID-msmd-931q-abhe | The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. |
CVE-2015-5964
GHSA-x38m-486c-2wr9 PYSEC-2015-23 |
| VCID-mux4-uv98-hbbw | Django vulnerable to SQL injection in column aliases An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB). |
CVE-2025-59681
GHSA-hpr9-3m2g-3j9p |
| VCID-mv1p-yxvp-pbh6 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. |
CVE-2018-7536
GHSA-r28v-mw67-m5p9 PYSEC-2018-5 |
| VCID-mzdk-m12w-q3fc | In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. |
BIT-django-2021-44420
CVE-2021-44420 GHSA-v6rh-hp5x-86rv PYSEC-2021-439 |
| VCID-nda7-9219-6kce | Django vulnerable to Uncontrolled Resource Consumption An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
CVE-2026-25673
GHSA-8p8v-wh79-9r56 |
| VCID-nese-5485-hkbs | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. |
BIT-django-2023-23969
CVE-2023-23969 GHSA-q2jf-h9jm-m7p4 PYSEC-2023-12 |
| VCID-p1dq-27t5-e7b3 | The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer. |
CVE-2010-4535
GHSA-7wph-fc4w-wqp2 PYSEC-2011-9 |
| VCID-p9fd-1qx2-8ubc | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. |
BIT-django-2025-27556
CVE-2025-27556 GHSA-wqfg-m96j-85vm PYSEC-2025-14 |
| VCID-pa75-6avj-duf7 | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. |
BIT-django-2022-28346
CVE-2022-28346 GHSA-2gwj-7jmv-h26r PYSEC-2022-190 |
| VCID-pv1d-wrex-hbgy | The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter. |
CVE-2010-4534
GHSA-fwr5-q9rx-294f PYSEC-2011-8 |
| VCID-q12d-kv8p-8ff7 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. |
BIT-django-2024-39329
CVE-2024-39329 GHSA-x7q2-wr7g-xqmf PYSEC-2024-57 |
| VCID-q64b-r7td-2yab | Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. |
CVE-2014-1418
GHSA-q7q2-qf2q-rw3w PYSEC-2014-19 |
| VCID-qjez-qe32-e3b6 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. |
CVE-2019-12781
GHSA-6c7v-2f49-8h26 PYSEC-2019-10 |
| VCID-qjqs-zfd5-ckbt | Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag. |
CVE-2013-4315
GHSA-vjjp-9r83-22rc PYSEC-2013-20 |
| VCID-qm34-ec8s-tfd7 | Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. |
BIT-django-2021-33203
CVE-2021-33203 GHSA-68w8-qjq3-2gfm PYSEC-2021-98 |
| VCID-qzba-9xmg-3qer | The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path." |
CVE-2014-0472
GHSA-rvq6-mrpv-m6rm PYSEC-2014-1 |
| VCID-rkt5-kwum-43c8 | The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests. |
CVE-2008-3909
GHSA-r5cj-wv24-92p5 PYSEC-2008-2 |
| VCID-sbr6-pybe-dubq | Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. |
CVE-2015-5144
GHSA-q5qw-4364-5hhm PYSEC-2015-10 |
| VCID-spwd-dz6f-5fh9 | The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL. |
CVE-2015-0220
GHSA-gv98-g628-m9x5 PYSEC-2015-5 |
| VCID-t3um-xpzf-23eg | The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information. |
CVE-2013-0305
GHSA-r7w6-p47g-vj53 PYSEC-2013-16 |
| VCID-t6uc-dfrd-jyfg | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. |
BIT-django-2022-34265
CVE-2022-34265 GHSA-p64x-8rxx-wf6q PYSEC-2022-213 |
| VCID-t8d7-68j2-suet | validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. |
CVE-2015-5145
GHSA-cqf7-ff9h-7967 PYSEC-2015-21 |
| VCID-t8ec-st1v-s3e5 | Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header. |
CVE-2015-0219
GHSA-7qfw-j7hp-v45g PYSEC-2015-4 |
| VCID-th9v-dk98-3kea | A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name. |
BIT-django-2022-28347
CVE-2022-28347 GHSA-w24h-v9qh-8gxj PYSEC-2022-191 |
| VCID-ttm3-5a6e-wfa1 | Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request. |
CVE-2011-4139
GHSA-rm2j-x595-q9cj PYSEC-2011-4 |
| VCID-u3zk-tff2-aua9 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. |
BIT-django-2024-39614
CVE-2024-39614 GHSA-f6f8-9mx6-9mx2 PYSEC-2024-59 |
| VCID-u7m5-tzv2-c7hn | In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. |
BIT-django-2021-28658
CVE-2021-28658 GHSA-xgxc-v2qg-chmh PYSEC-2021-6 |
| VCID-uk1w-hehw-dyda | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. |
CVE-2016-9013
GHSA-mv8g-fhh6-6267 PYSEC-2016-17 |
| VCID-ukkt-wgau-t3et | Django is vulnerable to DoS via XML serializer text extraction An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
CVE-2025-64460
GHSA-vrcr-9hj9-jcg6 |
| VCID-ukxp-wqpr-t3by | The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com. |
CVE-2016-2512
GHSA-pw27-w7w4-9qc7 PYSEC-2016-15 |
| VCID-ume2-wt6y-jye7 | The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS. |
BIT-django-2022-22818
CVE-2022-22818 GHSA-95rw-fx8r-36v6 PYSEC-2022-19 |
| VCID-upy5-adtx-n7hg | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command. |
BIT-django-2020-24583
CVE-2020-24583 GHSA-m6gj-h9gm-gw44 PYSEC-2020-33 |
| VCID-ura5-t7s9-8fck | The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header. |
CVE-2011-4138
GHSA-wxg3-mfph-qg9w PYSEC-2011-3 |
| VCID-uwnu-rz61-d3c8 | Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie. |
CVE-2010-3082
GHSA-fxpg-gg9g-76gj PYSEC-2010-12 |
| VCID-v1xr-z4zu-yfb4 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. |
BIT-django-2024-41989
CVE-2024-41989 GHSA-jh75-99hh-qvx9 PYSEC-2024-67 |
| VCID-v466-zd6u-dqce | Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request. |
CVE-2008-2302
GHSA-54qj-48vx-cr9f PYSEC-2008-1 |
| VCID-v4ad-xxy8-wfc9 | In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. |
BIT-django-2021-32052
CVE-2021-32052 GHSA-qm57-vhq3-3fwf PYSEC-2021-8 |
| VCID-vwt9-q3dt-vbfg | Django is vulnerable to SQL injection in column aliases An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. |
CVE-2025-13372
GHSA-rqw2-ghq9-44m7 |
| VCID-w2dv-u8h6-sbgs | Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL. |
BIT-django-2020-7471
CVE-2020-7471 GHSA-hmr4-m2h5-33qx PYSEC-2020-35 |
| VCID-w4pr-k5nj-ckgy | Django is subject to SQL injection through its column aliases An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias(). |
CVE-2025-57833
GHSA-6w2r-r2m5-xq5w |
| VCID-w6k8-js68-87g4 | Multiple vulnerabilities have been found in Python, the worst of which might allow attackers to access sensitive information. |
CVE-2021-23336
|
| VCID-wb34-g6xq-rkfx | Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. |
BIT-django-2020-9402
CVE-2020-9402 GHSA-3gh2-xw74-jmcw PYSEC-2020-36 |
| VCID-wkrc-62bd-bbgx | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. |
BIT-django-2020-13254
CVE-2020-13254 GHSA-wpjr-j57x-wxfw PYSEC-2020-31 |
| VCID-wwa5-mhgu-9khz | Django denial-of-service in django.utils.html.strip_tags() An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. |
CVE-2024-53907
GHSA-8498-2h75-472j |
| VCID-wz1q-1tjp-4qhw | In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. |
BIT-django-2023-36053
CVE-2023-36053 GHSA-jh3w-4vvf-mjgr PYSEC-2023-100 |
| VCID-x4ev-6zjm-sbe4 | Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. |
CVE-2016-6186
GHSA-c8c8-9472-w52h PYSEC-2016-2 |
| VCID-x664-bfna-6qdv | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. |
CVE-2019-3498
GHSA-337x-4q8g-prc5 PYSEC-2019-17 |
| VCID-x6np-rvrt-nyb2 | The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed. |
CVE-2013-1443
GHSA-4c42-4rxm-x6qf PYSEC-2013-18 |
| VCID-xaqg-mhqa-7keg | Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. |
CVE-2019-6975
GHSA-wh4h-v3f2-r2pp PYSEC-2019-18 |
| VCID-xgv1-s2ek-q3dp | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings. |
BIT-django-2025-26699
CVE-2025-26699 GHSA-p3fp-8748-vqfq PYSEC-2025-13 |
| VCID-xtqq-9751-r3dq | The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521. |
CVE-2011-4137
GHSA-3jqw-crqj-w8qw PYSEC-2011-2 |
| VCID-y8fz-krt7-vkhp | Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission. |
CVE-2016-2048
GHSA-46x4-9jmv-jc8p PYSEC-2016-14 |
| VCID-yemh-qd63-wuca | The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting." |
CVE-2014-0474
GHSA-wqjj-hx84-v449 PYSEC-2014-3 |
| VCID-ypub-ukuh-p3aw | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. |
BIT-django-2023-24580
CVE-2023-24580 GHSA-2hrw-hx67-34x6 PYSEC-2023-13 |
| VCID-ysyp-h7ja-yff3 | Django has an SQL Injection issue An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. |
CVE-2026-1207
GHSA-mwm9-4648-f68q |
| VCID-yx42-v5s7-h7ac | Django Arbitrary Code Execution `bin/compile-messages.py` in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file. |
CVE-2007-0404
GHSA-qc99-g3wm-hgxr |
| VCID-z27q-zfpz-ckby | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.) |
BIT-django-2024-39330
CVE-2024-39330 GHSA-9jmf-237g-qf46 PYSEC-2024-58 |
| VCID-z8z1-cjee-kfeg | An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack. |
BIT-django-2021-45115
CVE-2021-45115 GHSA-53qw-q765-4fww PYSEC-2022-1 |