Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/django@1.8rc1
purl pkg:pypi/django@1.8rc1
Tags Ghost
Next non-vulnerable version 4.2.29
Latest non-vulnerable version 6.0.4
Risk 10.0
Vulnerabilities affecting this package (8)
Vulnerability Summary Fixed by
VCID-325d-7dfk-sqd2
Aliases:
CVE-2016-2513
GHSA-fp6p-5xvw-m74f
PYSEC-2016-16
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
1.8.10
Affected by 18 other vulnerabilities.
1.9.3
Affected by 16 other vulnerabilities.
VCID-8jaq-53td-wbeg
Aliases:
CVE-2019-19844
GHSA-vfq6-hq5r-27r6
PYSEC-2019-16
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
1.11.27
Affected by 9 other vulnerabilities.
2.2.9
Affected by 27 other vulnerabilities.
3.0.1
Affected by 20 other vulnerabilities.
VCID-8teq-9xr9-q3fg
Aliases:
CVE-2016-7401
GHSA-crhm-qpjc-cm64
PYSEC-2016-3
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
1.8.15
Affected by 16 other vulnerabilities.
1.9.10
Affected by 14 other vulnerabilities.
VCID-k6s1-gnmc-e3ed
Aliases:
CVE-2016-9014
GHSA-3f2c-jm6v-cr35
PYSEC-2016-18
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
1.8.16
Affected by 14 other vulnerabilities.
1.9.11
Affected by 12 other vulnerabilities.
1.10.3
Affected by 13 other vulnerabilities.
VCID-qm34-ec8s-tfd7
Aliases:
BIT-django-2021-33203
CVE-2021-33203
GHSA-68w8-qjq3-2gfm
PYSEC-2021-98
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
2.2.24
Affected by 14 other vulnerabilities.
3.1.12
Affected by 8 other vulnerabilities.
3.2.4
Affected by 26 other vulnerabilities.
VCID-ukxp-wqpr-t3by
Aliases:
CVE-2016-2512
GHSA-pw27-w7w4-9qc7
PYSEC-2016-15
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
1.8.10
Affected by 18 other vulnerabilities.
1.9.3
Affected by 16 other vulnerabilities.
VCID-x4ev-6zjm-sbe4
Aliases:
CVE-2016-6186
GHSA-c8c8-9472-w52h
PYSEC-2016-2
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
1.8.14
Affected by 17 other vulnerabilities.
1.9.8
Affected by 15 other vulnerabilities.
1.10rc1
Affected by 14 other vulnerabilities.
VCID-x516-xwze-6ba3
Aliases:
PYSEC-2019-86
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
1.11.27
Affected by 9 other vulnerabilities.
2.2.9
Affected by 27 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-04T14:30:40.015370+00:00 GHSA Importer Fixing VCID-gvvs-megy-9fc3 https://github.com/advisories/GHSA-j3j3-jrfh-cm2w 38.1.0
2026-04-04T14:30:39.859191+00:00 GHSA Importer Fixing VCID-jumh-hkhx-7qc9 https://github.com/advisories/GHSA-7fq8-4pv5-5w5c 38.1.0
2026-04-01T15:09:42.468249+00:00 PyPI Importer Affected by VCID-qm34-ec8s-tfd7 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T15:01:20.038353+00:00 PyPI Importer Affected by VCID-x516-xwze-6ba3 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T15:01:18.832215+00:00 PyPI Importer Affected by VCID-8jaq-53td-wbeg https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:39.804066+00:00 PyPI Importer Affected by VCID-k6s1-gnmc-e3ed https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:38.511106+00:00 PyPI Importer Affected by VCID-8teq-9xr9-q3fg https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:29.618068+00:00 PyPI Importer Affected by VCID-x4ev-6zjm-sbe4 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:25.739180+00:00 PyPI Importer Affected by VCID-ukxp-wqpr-t3by https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:25.038965+00:00 PyPI Importer Affected by VCID-325d-7dfk-sqd2 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:19.145996+00:00 PyPI Importer Fixing VCID-jumh-hkhx-7qc9 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T14:59:18.147320+00:00 PyPI Importer Fixing VCID-gvvs-megy-9fc3 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.0.0
2026-04-01T13:10:45.834998+00:00 GithubOSV Importer Fixing VCID-gvvs-megy-9fc3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j3j3-jrfh-cm2w/GHSA-j3j3-jrfh-cm2w.json 38.0.0
2026-04-01T13:09:02.154045+00:00 GithubOSV Importer Fixing VCID-jumh-hkhx-7qc9 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7fq8-4pv5-5w5c/GHSA-7fq8-4pv5-5w5c.json 38.0.0
2026-04-01T12:50:34.811225+00:00 GitLab Importer Fixing VCID-gvvs-megy-9fc3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2015-2316.yml 38.0.0
2026-04-01T12:50:29.818386+00:00 GitLab Importer Fixing VCID-jumh-hkhx-7qc9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2015-2317.yml 38.0.0
2026-04-01T12:46:03.404000+00:00 Pypa Importer Affected by VCID-qm34-ec8s-tfd7 https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2021-98.yaml 38.0.0
2026-04-01T12:42:10.377224+00:00 Pypa Importer Affected by VCID-8jaq-53td-wbeg https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2019-16.yaml 38.0.0
2026-04-01T12:41:24.279230+00:00 Pypa Importer Affected by VCID-k6s1-gnmc-e3ed https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-18.yaml 38.0.0
2026-04-01T12:41:23.454165+00:00 Pypa Importer Affected by VCID-8teq-9xr9-q3fg https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-3.yaml 38.0.0
2026-04-01T12:41:19.118290+00:00 Pypa Importer Affected by VCID-x4ev-6zjm-sbe4 https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-2.yaml 38.0.0
2026-04-01T12:41:16.983382+00:00 Pypa Importer Affected by VCID-325d-7dfk-sqd2 https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-16.yaml 38.0.0
2026-04-01T12:41:16.671902+00:00 Pypa Importer Affected by VCID-ukxp-wqpr-t3by https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2016-15.yaml 38.0.0
2026-04-01T12:41:13.468225+00:00 Pypa Importer Fixing VCID-jumh-hkhx-7qc9 https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2015-9.yaml 38.0.0
2026-04-01T12:41:12.980068+00:00 Pypa Importer Fixing VCID-gvvs-megy-9fc3 https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2015-18.yaml 38.0.0