Search for packages
| purl | pkg:deb/debian/python-django@1.0.2-1%2Blenny3 |
| Next non-vulnerable version | 3:3.2.25-0+deb12u3 |
| Latest non-vulnerable version | 3:5.2.14-2 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-18gm-v5zp-tqf9
Aliases: CVE-2009-3695 GHSA-p6m5-h7pp-v2x5 PYSEC-2009-4 |
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression. |
Affected by 121 other vulnerabilities. |
|
VCID-29qk-rv5n-efbm
Aliases: BIT-django-2022-36359 CVE-2022-36359 GHSA-8x94-hmjh-97hq PYSEC-2022-245 |
Affected by 43 other vulnerabilities. |
|
|
VCID-2n2n-1fq2-7bbs
Aliases: BIT-django-2022-34265 CVE-2022-34265 GHSA-p64x-8rxx-wf6q PYSEC-2022-213 |
sql injection |
Affected by 43 other vulnerabilities. |
|
VCID-2yaw-hhv6-fygg
Aliases: CVE-2016-2048 GHSA-46x4-9jmv-jc8p PYSEC-2016-14 |
Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission. |
Affected by 70 other vulnerabilities. |
|
VCID-322v-ntsv-7uge
Aliases: CVE-2018-14574 GHSA-5hg3-6c2f-f3wr PYSEC-2018-2 |
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-38e1-hepp-vkg9
Aliases: CVE-2011-4137 GHSA-3jqw-crqj-w8qw PYSEC-2011-2 |
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521. |
Affected by 104 other vulnerabilities. |
|
VCID-3juv-mecf-akdp
Aliases: CVE-2013-0305 GHSA-r7w6-p47g-vj53 PYSEC-2013-16 |
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information. |
Affected by 104 other vulnerabilities. |
|
VCID-3kza-a88p-kfg7
Aliases: CVE-2016-6186 GHSA-c8c8-9472-w52h PYSEC-2016-2 |
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-3mfy-uj9u-d7de
Aliases: CVE-2019-12781 GHSA-6c7v-2f49-8h26 PYSEC-2019-10 |
silent downgrade |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-3sg7-t77d-rkc6
Aliases: CVE-2014-0473 GHSA-89hj-xfx5-7q66 PYSEC-2014-2 |
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-492e-xffn-3bds
Aliases: CVE-2013-0306 GHSA-g8xg-jgj6-49r3 PYSEC-2013-17 |
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter. |
Affected by 104 other vulnerabilities. |
|
VCID-4cp2-k4mn-8ffj
Aliases: BIT-django-2020-13596 CVE-2020-13596 GHSA-2m34-jcjv-45xf PYSEC-2020-32 |
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-4kcg-gx5y-cuaw
Aliases: BIT-django-2026-1207 CVE-2026-1207 GHSA-mwm9-4648-f68q PYSEC-2026-44 |
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue. |
Affected by 17 other vulnerabilities. |
|
VCID-4tyd-97z5-z3ar
Aliases: CVE-2024-45231 GHSA-rrqc-c2jx-6jgv |
Django allows enumeration of user e-mail addresses An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-4z4e-8ttu-tyd6
Aliases: BIT-django-2023-24580 CVE-2023-24580 GHSA-2hrw-hx67-34x6 PYSEC-2023-13 |
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. |
Affected by 43 other vulnerabilities. |
|
VCID-51tx-4tp9-kbcz
Aliases: BIT-django-2022-23833 CVE-2022-23833 GHSA-6cw3-g6wv-c2xv PYSEC-2022-20 |
Affected by 43 other vulnerabilities. |
|
|
VCID-5brz-383w-pfbb
Aliases: CVE-2011-4136 GHSA-x88j-93vc-wpmp PYSEC-2011-1 |
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier. |
Affected by 104 other vulnerabilities. |
|
VCID-5dxz-7swx-rygn
Aliases: CVE-2012-4520 GHSA-2655-q453-22f9 PYSEC-2012-7 |
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values. |
Affected by 104 other vulnerabilities. |
|
VCID-5q58-pzt4-8uey
Aliases: BIT-django-2020-7471 CVE-2020-7471 GHSA-hmr4-m2h5-33qx PYSEC-2020-35 |
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-5vmb-d4xp-zfgy
Aliases: CVE-2015-0219 GHSA-7qfw-j7hp-v45g PYSEC-2015-4 |
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header. |
Affected by 104 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-5xtt-au84-zbb2
Aliases: BIT-django-2025-59681 CVE-2025-59681 GHSA-hpr9-3m2g-3j9p PYSEC-2025-106 |
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB). |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-66ax-8wdn-1bgb
Aliases: CVE-2011-4138 GHSA-wxg3-mfph-qg9w PYSEC-2011-3 |
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header. |
Affected by 104 other vulnerabilities. |
|
VCID-6jpg-yrf8-cufy
Aliases: BIT-django-2021-45115 CVE-2021-45115 GHSA-53qw-q765-4fww PYSEC-2022-1 |
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack. |
Affected by 43 other vulnerabilities. |
|
VCID-6wah-r8vr-5qc4
Aliases: CVE-2016-2513 GHSA-fp6p-5xvw-m74f PYSEC-2016-16 |
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-71t1-69yq-c7h6
Aliases: CVE-2014-1418 GHSA-q7q2-qf2q-rw3w PYSEC-2014-19 |
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-7c5n-nzwk-v7bz
Aliases: BIT-django-2025-13372 CVE-2025-13372 GHSA-rqw2-ghq9-44m7 PYSEC-2025-104 |
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-7cnm-hzsf-tybp
Aliases: CVE-2010-4534 GHSA-fwr5-q9rx-294f PYSEC-2011-28 PYSEC-2011-8 |
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter. |
Affected by 104 other vulnerabilities. |
|
VCID-7g7m-bfe1-wkhd
Aliases: CVE-2012-3443 GHSA-59w8-4wm2-4xw8 PYSEC-2012-3 |
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. |
Affected by 104 other vulnerabilities. |
|
VCID-7rz2-nqdn-hycc
Aliases: CVE-2014-0480 GHSA-f7cm-ccfp-3q4r PYSEC-2014-4 |
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-8gus-er59-1qak
Aliases: CVE-2016-9014 GHSA-3f2c-jm6v-cr35 PYSEC-2016-18 |
multiple issues |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-8v2c-7739-2ugp
Aliases: CVE-2014-0483 GHSA-rw75-m7gp-92m3 PYSEC-2014-7 |
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-912q-3eks-4yfm
Aliases: CVE-2015-0220 GHSA-gv98-g628-m9x5 PYSEC-2015-5 |
The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL. |
Affected by 104 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-9bqp-b6rw-mye7
Aliases: CVE-2014-3730 GHSA-vq3h-3q7v-9prw PYSEC-2014-20 |
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-9bsf-vm3b-ubhw
Aliases: CVE-2012-3442 GHSA-78vx-ggch-wghm PYSEC-2012-2 |
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. |
Affected by 104 other vulnerabilities. |
|
VCID-9end-mq19-rke5
Aliases: BIT-django-2021-45452 CVE-2021-45452 GHSA-jrh2-hc4r-7jwx PYSEC-2022-3 |
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. |
Affected by 43 other vulnerabilities. |
|
VCID-9kvc-1bdz-n3bd
Aliases: BIT-django-2025-32873 CVE-2025-32873 GHSA-8j24-cjrq-gr2m PYSEC-2025-37 |
denial of service |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-9mpt-zxaw-kkeg
Aliases: BIT-django-2021-33203 CVE-2021-33203 GHSA-68w8-qjq3-2gfm PYSEC-2021-98 |
multiple issues |
Affected by 43 other vulnerabilities. |
|
VCID-attf-6gj8-ebaj
Aliases: BIT-django-2022-22818 CVE-2022-22818 GHSA-95rw-fx8r-36v6 PYSEC-2022-19 |
Affected by 43 other vulnerabilities. |
|
|
VCID-au8h-vj9k-pufv
Aliases: BIT-django-2023-23969 CVE-2023-23969 GHSA-q2jf-h9jm-m7p4 PYSEC-2023-12 |
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. |
Affected by 43 other vulnerabilities. |
|
VCID-bahz-gfxv-e3b2
Aliases: CVE-2015-2317 GHSA-7fq8-4pv5-5w5c PYSEC-2015-9 |
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. |
Affected by 104 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-bb8b-hq41-s7a6
Aliases: BIT-django-2025-48432 CVE-2025-48432 GHSA-7xr5-9hcq-chf9 PYSEC-2025-47 |
An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-c3m7-fu62-2qd9
Aliases: CVE-2019-14232 GHSA-c4qh-4vgv-qc6g PYSEC-2019-11 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-c58g-7jpv-t7hc
Aliases: CVE-2018-7536 GHSA-r28v-mw67-m5p9 PYSEC-2018-5 |
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-dh12-js4b-h7fw
Aliases: CVE-2015-0222 GHSA-6g95-x6cj-mg4v PYSEC-2015-7 |
ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries. |
Affected by 84 other vulnerabilities. |
|
VCID-drwp-htkk-bkfh
Aliases: BIT-django-2022-28347 CVE-2022-28347 GHSA-w24h-v9qh-8gxj PYSEC-2022-191 |
sql injection |
Affected by 43 other vulnerabilities. |
|
VCID-e12b-tw2c-53c9
Aliases: BIT-django-2024-41991 CVE-2024-41991 GHSA-r836-hh6v-rg5g PYSEC-2024-69 |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-e8j6-mybr-17fh
Aliases: BIT-django-2024-39330 CVE-2024-39330 GHSA-9jmf-237g-qf46 PYSEC-2024-58 |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.) |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-f1br-hvnm-wfdg
Aliases: CVE-2019-3498 GHSA-337x-4q8g-prc5 PYSEC-2019-17 |
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-f4a7-tcz5-byfj
Aliases: BIT-django-2023-36053 CVE-2023-36053 GHSA-jh3w-4vvf-mjgr PYSEC-2023-100 |
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. |
Affected by 43 other vulnerabilities. |
|
VCID-fcg9-xypn-ykhf
Aliases: BIT-django-2025-64460 CVE-2025-64460 GHSA-vrcr-9hj9-jcg6 PYSEC-2025-109 |
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-ffsr-th58-p3ct
Aliases: CVE-2014-0474 GHSA-wqjj-hx84-v449 PYSEC-2014-3 |
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting." |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-fhp8-tck4-mye4
Aliases: BIT-django-2021-28658 CVE-2021-28658 GHSA-xgxc-v2qg-chmh PYSEC-2021-6 |
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. |
Affected by 43 other vulnerabilities. |
|
VCID-fksk-pr23-2yd8
Aliases: BIT-django-2021-45116 CVE-2021-45116 GHSA-8c5j-9r9f-c6w8 PYSEC-2022-2 |
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key. |
Affected by 43 other vulnerabilities. |
|
VCID-fsaw-3ta1-x3dw
Aliases: BIT-django-2024-27351 CVE-2024-27351 GHSA-vm8q-m57g-pff3 PYSEC-2024-47 |
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-g2z3-2h8p-c7ge
Aliases: CVE-2013-4315 GHSA-vjjp-9r83-22rc PYSEC-2013-20 |
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-g44a-m54u-97cr
Aliases: CVE-2019-14235 GHSA-v9qg-3j8p-r63v PYSEC-2019-14 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-gfar-wbzc-3ubr
Aliases: CVE-2019-14233 GHSA-h5jv-4p7w-64jg PYSEC-2019-12 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-hh9b-52xn-z7a9
Aliases: BIT-django-2020-24584 CVE-2020-24584 GHSA-fr28-569j-53c4 PYSEC-2020-34 |
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077. |
Affected by 43 other vulnerabilities. |
|
VCID-hpj4-a9fa-4bca
Aliases: CVE-2017-12794 GHSA-9r8w-6x8c-6jr9 PYSEC-2017-44 |
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. |
Affected by 60 other vulnerabilities. |
|
VCID-j81e-su1y-tqa6
Aliases: BIT-django-2021-31542 CVE-2021-31542 GHSA-rxjp-mfm9-w4wr PYSEC-2021-7 |
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. |
Affected by 43 other vulnerabilities. |
|
VCID-jfya-694v-myar
Aliases: CVE-2015-5143 GHSA-h582-2pch-3xv3 PYSEC-2015-20 |
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. |
|
VCID-jgv9-vdbm-sycd
Aliases: BIT-django-2024-41989 CVE-2024-41989 GHSA-jh75-99hh-qvx9 PYSEC-2024-67 |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-jybd-p65h-xffy
Aliases: BIT-django-2025-13473 CVE-2025-13473 GHSA-2mcm-79hx-8fxw PYSEC-2026-42 |
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue. |
Affected by 17 other vulnerabilities. |
|
VCID-k9tv-r6pm-kqdb
Aliases: CVE-2007-5828 |
Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module |
Affected by 121 other vulnerabilities. |
|
VCID-kbab-v2gz-dfe6
Aliases: CVE-2019-12308 GHSA-7rp2-fm2h-wchj PYSEC-2019-79 |
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-kq8u-td31-uqaa
Aliases: CVE-2015-5963 GHSA-pgxh-wfw4-jx2v PYSEC-2015-22 |
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. |
|
VCID-ksh8-pazn-dbca
Aliases: CVE-2016-2512 GHSA-pw27-w7w4-9qc7 PYSEC-2016-15 |
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-kuyz-3pxs-r7cv
Aliases: CVE-2011-0696 GHSA-5j2h-h5hg-3wf8 PYSEC-2011-10 PYSEC-2011-30 |
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447. |
Affected by 104 other vulnerabilities. |
|
VCID-m1dr-sjmw-jfd2
Aliases: BIT-django-2022-41323 CVE-2022-41323 GHSA-qrw5-5h28-6cmg PYSEC-2022-304 |
Affected by 43 other vulnerabilities. |
|
|
VCID-m33h-4p9q-63fb
Aliases: BIT-django-2023-43665 CVE-2023-43665 GHSA-h8gc-pgj2-vjm3 PYSEC-2023-226 |
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-m4wa-xv9b-q7ce
Aliases: BIT-django-2020-9402 CVE-2020-9402 GHSA-3gh2-xw74-jmcw PYSEC-2020-345 PYSEC-2020-36 |
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. |
Affected by 43 other vulnerabilities. |
|
VCID-mccp-khb9-qkb7
Aliases: CVE-2015-5144 GHSA-q5qw-4364-5hhm PYSEC-2015-10 |
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. |
|
VCID-n2v7-jqjy-37bc
Aliases: CVE-2025-59682 GHSA-q95w-c7qg-hrff |
Django vulnerable to partial directory traversal via archives An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-n6ps-f6s6-zkbj
Aliases: CVE-2011-0697 GHSA-8m3r-rv5g-fcpq PYSEC-2011-11 PYSEC-2011-31 |
Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload. |
Affected by 104 other vulnerabilities. |
|
VCID-n9vn-4uxr-hkau
Aliases: BIT-django-2021-44420 CVE-2021-44420 GHSA-v6rh-hp5x-86rv PYSEC-2021-439 |
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. |
Affected by 43 other vulnerabilities. |
|
VCID-na9w-xkvx-cbhd
Aliases: BIT-django-2020-13254 CVE-2020-13254 GHSA-wpjr-j57x-wxfw PYSEC-2020-31 |
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-nss9-1yrb-x7f2
Aliases: BIT-django-2022-28346 CVE-2022-28346 GHSA-2gwj-7jmv-h26r PYSEC-2022-190 |
sql injection |
Affected by 43 other vulnerabilities. |
|
VCID-pa7y-gpwp-6qgj
Aliases: BIT-django-2024-56374 CVE-2024-56374 GHSA-qcgg-j2x8-h9g8 PYSEC-2025-1 |
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.) |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-pgtx-cdua-kfb4
Aliases: CVE-2019-19118 GHSA-hvmf-r92r-27hr PYSEC-2019-15 |
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.) |
Affected by 43 other vulnerabilities. |
|
VCID-ps24-pjj4-uqd1
Aliases: CVE-2013-1443 GHSA-4c42-4rxm-x6qf PYSEC-2013-18 |
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-q8r2-m9s6-rbek
Aliases: BIT-django-2021-3281 CVE-2021-3281 GHSA-fvgf-6h6h-3322 PYSEC-2021-9 |
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. |
Affected by 43 other vulnerabilities. |
|
VCID-qgp1-4efd-6yg6
Aliases: BIT-django-2023-41164 CVE-2023-41164 GHSA-7h4p-27mh-hmrw PYSEC-2023-225 |
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-qu99-yudm-57fp
Aliases: CVE-2013-1665 GHSA-x64m-686f-fmm3 |
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack. |
Affected by 104 other vulnerabilities. |
|
VCID-qvfs-2v1h-p3h4
Aliases: BIT-django-2020-24583 CVE-2020-24583 GHSA-m6gj-h9gm-gw44 PYSEC-2020-33 |
An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command. |
Affected by 43 other vulnerabilities. |
|
VCID-qy1a-x3ff-4bc8
Aliases: BIT-django-2025-26699 CVE-2025-26699 GHSA-p3fp-8748-vqfq PYSEC-2025-13 |
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-qy2a-mvpz-q7eh
Aliases: CVE-2016-9013 GHSA-mv8g-fhh6-6267 PYSEC-2016-17 |
multiple issues |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-r2a9-kym9-zqgq
Aliases: CVE-2010-4535 GHSA-7wph-fc4w-wqp2 PYSEC-2011-29 PYSEC-2011-9 |
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer. |
Affected by 104 other vulnerabilities. |
|
VCID-r7tk-79xy-jkhj
Aliases: CVE-2014-0481 GHSA-296w-6qhq-gf92 PYSEC-2014-5 |
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-rq19-9v21-47dy
Aliases: CVE-2014-0472 GHSA-rvq6-mrpv-m6rm PYSEC-2014-1 |
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path." |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-rruq-9scz-vbg8
Aliases: CVE-2017-7233 GHSA-37hp-765x-j95x PYSEC-2017-9 |
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-rxxr-sseq-k7a9
Aliases: CVE-2015-8213 GHSA-6wcr-wcqm-3mfh PYSEC-2015-11 |
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-s1rj-1xbw-fbg5
Aliases: BIT-django-2024-39614 CVE-2024-39614 GHSA-f6f8-9mx6-9mx2 PYSEC-2024-59 |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-shch-yusm-1uck
Aliases: BIT-django-2026-1285 CVE-2026-1285 GHSA-4rrr-2h4v-f3j9 PYSEC-2026-45 |
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue. |
Affected by 17 other vulnerabilities. |
|
VCID-shjc-2j68-2yfy
Aliases: BIT-django-2026-1312 CVE-2026-1312 GHSA-6426-9fv3-65x8 PYSEC-2026-47 |
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. |
Affected by 17 other vulnerabilities. |
|
VCID-sxtr-18b7-s7a7
Aliases: DSA-2740-2 python-django |
regression |
Affected by 104 other vulnerabilities. |
|
VCID-t952-ghnf-jkby
Aliases: CVE-2019-6975 GHSA-wh4h-v3f2-r2pp PYSEC-2019-18 |
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-ta66-7qrm-sbhu
Aliases: CVE-2015-0221 GHSA-jhjg-w2cp-5j44 PYSEC-2015-6 |
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file. |
Affected by 104 other vulnerabilities. Affected by 84 other vulnerabilities. |
|
VCID-th75-ys47-d3h8
Aliases: CVE-2015-5964 GHSA-x38m-486c-2wr9 PYSEC-2015-23 |
The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. |
Affected by 104 other vulnerabilities. Affected by 80 other vulnerabilities. |
|
VCID-tx5w-s2xx-t7gj
Aliases: CVE-2010-3082 GHSA-fxpg-gg9g-76gj PYSEC-2010-12 |
Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie. |
Affected by 121 other vulnerabilities. |
|
VCID-u4a7-uvcb-9kf8
Aliases: CVE-2014-0482 GHSA-625g-gx8c-xcmg PYSEC-2014-6 |
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-u4sa-1yn4-h3ff
Aliases: CVE-2009-2659 GHSA-9xg7-gg9m-rmq9 PYSEC-2009-3 |
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL. |
Affected by 121 other vulnerabilities. |
|
VCID-u5u9-xbb6-93hc
Aliases: CVE-2011-4139 GHSA-rm2j-x595-q9cj PYSEC-2011-4 |
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request. |
Affected by 104 other vulnerabilities. |
|
VCID-u6sd-648r-qbdb
Aliases: CVE-2015-2241 GHSA-6565-fg86-6jcx PYSEC-2015-8 |
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property. |
Affected by 84 other vulnerabilities. |
|
VCID-u9q1-63gf-7feh
Aliases: BIT-django-2021-32052 CVE-2021-32052 GHSA-qm57-vhq3-3fwf PYSEC-2021-8 |
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. |
Affected by 43 other vulnerabilities. |
|
VCID-ud73-4t2c-n3at
Aliases: BIT-django-2024-53907 CVE-2024-53907 GHSA-8498-2h75-472j PYSEC-2024-156 |
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-upbz-vg19-rugv
Aliases: CVE-2017-7234 GHSA-h4hv-m4h4-mhwg PYSEC-2017-10 |
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-vacy-878s-3kfb
Aliases: CVE-2015-2316 GHSA-j3j3-jrfh-cm2w PYSEC-2015-18 |
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. |
Affected by 84 other vulnerabilities. |
|
VCID-vdpf-jddk-syda
Aliases: CVE-2019-19844 GHSA-vfq6-hq5r-27r6 PYSEC-2019-16 |
insufficient validation |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-vgq9-s6th-yufg
Aliases: BIT-django-2024-39329 CVE-2024-39329 GHSA-x7q2-wr7g-xqmf PYSEC-2024-57 |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-vj5u-2ukv-audq
Aliases: CVE-2012-3444 GHSA-5h2q-4hrp-v9rr PYSEC-2012-4 |
The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. |
Affected by 104 other vulnerabilities. |
|
VCID-wa3g-27sx-mbcw
Aliases: BIT-django-2026-1287 CVE-2026-1287 GHSA-gvg8-93h5-g6qq PYSEC-2026-46 |
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue. |
Affected by 17 other vulnerabilities. |
|
VCID-wch3-d92x-sudf
Aliases: CVE-2018-6188 GHSA-rf4j-j272-fj86 PYSEC-2018-4 |
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive. |
Affected by 60 other vulnerabilities. |
|
VCID-weqb-fxu4-17e7
Aliases: CVE-2016-7401 GHSA-crhm-qpjc-cm64 PYSEC-2016-3 |
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. |
|
VCID-wfas-jszp-k7dz
Aliases: CVE-2013-4249 GHSA-4894-5vqc-6r2r PYSEC-2013-19 |
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField. |
Affected by 91 other vulnerabilities. |
|
VCID-whgc-pt2s-77ar
Aliases: BIT-django-2025-64459 CVE-2025-64459 GHSA-frmv-pr5f-9mcr PYSEC-2025-108 |
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-wnxx-rc7w-cke4
Aliases: CVE-2021-23336 |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) When the attacker can separate query parameters using a semicolon (`;`), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. |
Affected by 43 other vulnerabilities. |
|
VCID-x212-mskt-9bbw
Aliases: CVE-2013-6044 GHSA-9cwg-mhxf-hh59 PYSEC-2013-21 |
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme. |
Affected by 104 other vulnerabilities. Affected by 91 other vulnerabilities. |
|
VCID-x61x-6b6k-h3bn
Aliases: CVE-2018-7537 GHSA-2f9x-5v75-3qv4 PYSEC-2018-6 |
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
Affected by 80 other vulnerabilities. Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. |
|
VCID-xcmd-18ck-gqae
Aliases: BIT-django-2024-42005 CVE-2024-42005 GHSA-pv4p-cwwg-4rph PYSEC-2024-70 |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-xf2n-qua7-m7fb
Aliases: CVE-2011-4140 GHSA-h95j-h2rv-qrg4 PYSEC-2011-5 |
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. |
Affected by 104 other vulnerabilities. |
|
VCID-ynt9-h6ww-h7e9
Aliases: BIT-django-2025-57833 CVE-2025-57833 GHSA-6w2r-r2m5-xq5w PYSEC-2025-105 |
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias(). |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-yreb-z7nz-jkbs
Aliases: CVE-2019-14234 GHSA-6r97-cj55-9hrq PYSEC-2019-13 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-yuda-1mur-8bbq
Aliases: BIT-django-2024-24680 CVE-2024-24680 GHSA-xxj9-f6rv-m3x4 PYSEC-2024-28 |
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. |
Affected by 70 other vulnerabilities. Affected by 60 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-z4x1-e7tp-rqhz
Aliases: BIT-django-2021-33571 CVE-2021-33571 GHSA-p99v-5w3c-jqq9 PYSEC-2021-99 |
multiple issues |
Affected by 43 other vulnerabilities. |
|
VCID-z6tf-z1y9-cydq
Aliases: BIT-django-2023-31047 CVE-2023-31047 GHSA-r3xc-prgr-mg9p PYSEC-2023-61 |
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. |
Affected by 43 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4z7r-xd8z-3ybm | The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers. |
CVE-2007-5712
GHSA-9v8h-57gv-qch6 PYSEC-2007-1 |
| VCID-sj21-65x3-buh5 | The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests. |
CVE-2008-3909
GHSA-r5cj-wv24-92p5 PYSEC-2008-2 |
| VCID-ukf6-xwqc-xkdc | Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request. |
CVE-2008-2302
GHSA-54qj-48vx-cr9f PYSEC-2008-1 |