.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

django 4.2.29 vulnerabilities

162 advisories known · django@4.2.29 · 13 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 4.2.29

SEVERITYADVISORYPUBLISHED

HighDjango GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsingGHSA-wvqv-fj8w-qmhmBIT-django-2026-15307CVE-2026-15307PYSEC-2026-4035Affected <5.2.17, >=6.0a1 <6.0.8Fixed in 5.2.17 Fixed in 6.0.8OSV source ↗last month

HighDjango vulnerable to ASGI header spoofing via underscore/hyphen conflationGHSA-mvfq-ggxm-9mc5BIT-django-2026-3902CVE-2026-3902PYSEC-2026-51Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

HighDjango: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limitGHSA-933h-hp56-hf7mBIT-django-2026-33034CVE-2026-33034PYSEC-2026-49Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

MediumDjango has potential DoS via MultiPartParser through crafted multipart uploadsGHSA-5mf9-h53q-7mhqBIT-django-2026-33033CVE-2026-33033PYSEC-2026-48Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

MediumDjango: DomainNameValidator permits newline characters that may enable HTTP header injectionGHSA-8qcx-xf44-272xBIT-django-2026-53878CVE-2026-53878PYSEC-2026-2092Affected <5.2.16, >=6.0 <6.0.7Fixed in 5.2.16 Fixed in 6.0.7OSV source ↗4 months ago

MediumDjango GeoDjango vulnerable to denial of service through deeply nested geometry collectionsGHSA-q238-5cxm-5c9hBIT-django-2026-15830CVE-2026-15830PYSEC-2026-3717Affected <5.2.17, >=6.0a1 <6.0.8, >=6.1a1 <6.1.1Fixed in 5.2.17 Fixed in 6.0.8 Fixed in 6.1.1OSV source ↗3 months ago

Medium Django: GDALRaster may over-read heap memory when constructed from bytesGHSA-crhf-3pfg-w68wBIT-django-2026-53877CVE-2026-53877PYSEC-2026-2091Affected <5.2.16, >=6.0 <6.0.7Fixed in 5.2.16 Fixed in 6.0.7OSV source ↗4 months ago

LowDjango: cache middleware may expose private responses when unrelated request cookies are presentGHSA-3h9f-r86x-qvjxBIT-django-2026-48588CVE-2026-48588PYSEC-2026-2090Affected <5.2.16, >=6.0 <6.0.7Fixed in 5.2.16 Fixed in 6.0.7OSV source ↗4 months ago

LowDjango: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handlingGHSA-8cjm-8mp7-r2xfBIT-django-2026-8404CVE-2026-8404PYSEC-2026-201Affected <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango: signed cookies are vulnerable to salt namespace collisionsGHSA-h7pc-vwp9-298gBIT-django-2026-6873CVE-2026-6873PYSEC-2026-199Affected <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango: has_vary_header may expose cached responses when Vary values contain whitespaceGHSA-923m-gv2p-w5qpBIT-django-2026-48587CVE-2026-48587PYSEC-2026-198Affected <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango vulnerable to privilege abuse in GenericInlineModelAdminGHSA-pwjp-ccjc-ghwgBIT-django-2026-4277CVE-2026-4277PYSEC-2026-52Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

LowDjango vulnerable to privilege abuse in ModelAdmin.list_editableGHSA-mmwr-2jhp-mc7jBIT-django-2026-4292CVE-2026-4292PYSEC-2026-53Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

Does not affect 4.2.29

SEVERITYADVISORYPUBLISHED

CriticalDjango SQL injection in HasKey(lhs, rhs) on OracleGHSA-m9g8-fxxm-xg86BIT-django-2024-53908CVE-2024-53908PYSEC-2024-157Affected >=4.2 <4.2.17, >=5.0 <5.0.10, >=5.1 <5.1.4Fixed in 4.2.17 Fixed in 5.0.10 Fixed in 5.1.4OSV source ↗2 years ago

CriticalDjango bypasses validation when using one form field to upload multiple filesGHSA-r3xc-prgr-mg9pBIT-django-2023-31047CVE-2023-31047PYSEC-2023-61Affected >=3.2a1 <3.2.19, >=4.0a1 <4.1.9, >=4.2a1 <4.2.1Fixed in 3.2.19 Fixed in 4.1.9 Fixed in 4.2.1OSV source ↗4 years ago

CriticalDjango `Trunc()` and `Extract()` database functions vulnerable to SQL InjectionGHSA-p64x-8rxx-wf6qBIT-django-2022-34265CVE-2022-34265PYSEC-2022-213Affected >=3.2a1 <3.2.14, >=4.0a1 <4.0.6Fixed in 3.2.14 Fixed in 4.0.6OSV source ↗4 years ago

CriticalCode Injection in DjangoGHSA-rvq6-mrpv-m6rmCVE-2014-0472PYSEC-2014-1Affected <1.4.11, >=1.5 <1.5.6, >=1.6 <1.6.3Fixed in 1.4.11 Fixed in 1.5.6 Fixed in 1.6.3OSV source ↗4 years ago

CriticalDjango Vulnerable to MySQL InjectionGHSA-wqjj-hx84-v449CVE-2014-0474PYSEC-2014-3Affected <1.4.11, >=1.5 <1.5.6, >=1.6 <1.6.3Fixed in 1.4.11 Fixed in 1.5.6 Fixed in 1.6.3OSV source ↗4 years ago

CriticalSQL Injection in DjangoGHSA-2gwj-7jmv-h26rBIT-django-2022-28346CVE-2022-28346PYSEC-2022-190Affected >=2.2 <2.2.28, >=3.2 <3.2.13, >=4.0 <4.0.4Fixed in 2.2.28 Fixed in 3.2.13 Fixed in 4.0.4OSV source ↗5 years ago

CriticalSQL Injection in DjangoGHSA-w24h-v9qh-8gxjBIT-django-2022-28347CVE-2022-28347PYSEC-2022-191Affected >=2.2 <2.2.28, >=3.2 <3.2.13, >=4.0 <4.0.4Fixed in 2.2.28 Fixed in 3.2.13 Fixed in 4.0.4OSV source ↗5 years ago

CriticalSQL Injection in DjangoGHSA-xpfp-f569-q3p2BIT-django-2021-35042CVE-2021-35042PYSEC-2021-109Affected >=3.0a1 <3.1.13, >=3.2a1 <3.2.5Fixed in 3.1.13 Fixed in 3.2.5OSV source ↗5 years ago

CriticalSQL injection in DjangoGHSA-hmr4-m2h5-33qxBIT-django-2020-7471CVE-2020-7471PYSEC-2020-35Affected <1.11.28, >=2.0 <2.2.10, >=3.0 <3.0.3Fixed in 1.11.28 Fixed in 2.2.10 Fixed in 3.0.3OSV source ↗7 years ago

CriticalDjango Potential account hijack via password reset formGHSA-vfq6-hq5r-27r6CVE-2019-19844PYSEC-2019-16Affected <1.11.27, >=2.0 <2.2.9, >=3.0 <3.0.1Fixed in 1.11.27 Fixed in 2.2.9 Fixed in 3.0.1OSV source ↗7 years ago

CriticalSQL Injection in DjangoGHSA-6r97-cj55-9hrqCVE-2019-14234PYSEC-2019-13Affected >=1.11a1 <1.11.23, >=2.1a1 <2.1.11, >=2.2a1 <2.2.4Fixed in 1.11.23 Fixed in 2.1.11 Fixed in 2.2.4OSV source ↗7 years ago

CriticalDjango user with hardcoded password created when running tests on OracleGHSA-mv8g-fhh6-6267CVE-2016-9013PYSEC-2016-17Affected >=1.10a1 <1.10.3, >=1.8a1 <1.8.16, >=1.9a1 <1.9.11Fixed in 1.10.3 Fixed in 1.8.16 Fixed in 1.9.11OSV source ↗10 years ago

CriticalDjango vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.GHSA-frmv-pr5f-9mcrBIT-django-2025-64459CVE-2025-64459PYSEC-2025-108Affected <4.2.26, >=5.0a1 <5.1.14, >=5.2a1 <5.2.8Fixed in 4.2.26 Fixed in 5.1.14 Fixed in 5.2.8OSV source ↗last year

CriticalDjango SQL injection vulnerabilityGHSA-pv4p-cwwg-4rphBIT-django-2024-42005CVE-2024-42005PYSEC-2024-70Affected >=4.2 <4.2.15, >=5.0 <5.0.8Fixed in 4.2.15 Fixed in 5.0.8OSV source ↗2 years ago

CriticalDirectory traversal in DjangoGHSA-7g9h-c88w-r7h2CVE-2011-0698PYSEC-2011-12Affected >=1.1 <1.1.4, >=1.2 <1.2.5Fixed in 1.1.4 Fixed in 1.2.5OSV source ↗16 years ago

HighDjango vulnerable to Reflected File Download attackGHSA-8x94-hmjh-97hqBIT-django-2022-36359CVE-2022-36359PYSEC-2022-245Affected <3.2.15, >=4.0 <4.0.7Fixed in 3.2.15 Fixed in 4.0.7OSV source ↗4 years ago

HighSQL injection in DjangoGHSA-3gh2-xw74-jmcwBIT-django-2020-9402CVE-2020-9402PYSEC-2020-36Affected >=1.11 <1.11.29, >=2.2 <2.2.11, >=3.0 <3.0.4Fixed in 1.11.29 Fixed in 2.2.11 Fixed in 3.0.4OSV source ↗6 years ago

HighDjango Directory Traversal via ssi template tagGHSA-vjjp-9r83-22rcCVE-2013-4315PYSEC-2013-20Affected >=1.4 <1.4.7, >=1.5 <1.5.3Fixed in 1.4.7 Fixed in 1.5.3OSV source ↗13 years ago

HighDjango DNS Rebinding VulnerabilityGHSA-3f2c-jm6v-cr35CVE-2016-9014PYSEC-2016-18Affected <1.8.16, >=1.10a1 <1.10.3, >=1.9a1 <1.9.11Fixed in 1.10.3 Fixed in 1.8.16 Fixed in 1.9.11OSV source ↗10 years ago

HighDjango has an SQL Injection issueGHSA-gvg8-93h5-g6qqBIT-django-2026-1287CVE-2026-1287PYSEC-2026-46Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

HighDjango has an SQL Injection issueGHSA-mwm9-4648-f68qBIT-django-2026-1207CVE-2026-1207PYSEC-2026-44Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

HighDjango Arbitrary Code ExecutionGHSA-qc99-g3wm-hgxrCVE-2007-0404PYSEC-2026-630Affected >=0.95 <1.0Fixed in 1.0OSV source ↗5 years ago

HighDjango vulnerable to Uncontrolled Resource ConsumptionGHSA-8p8v-wh79-9r56BIT-django-2026-25673CVE-2026-25673PYSEC-2026-2448Affected >=4.2 <4.2.29, >=5.2 <5.2.12, >=6.0 <6.0.3Fixed in 4.2.29 Fixed in 5.2.12 Fixed in 6.0.3OSV source ↗8 months ago

HighDjango has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsGHSA-qw25-v68c-qjf3BIT-django-2025-64458CVE-2025-64458PYSEC-2025-107Affected <4.2.26, >=5.0a1 <5.1.14, >=5.2a1 <5.2.8Fixed in 4.2.26 Fixed in 5.1.14 Fixed in 5.2.8OSV source ↗last year

HighDjango denial-of-service in django.utils.html.strip_tags()GHSA-8498-2h75-472jBIT-django-2024-53907CVE-2024-53907PYSEC-2024-156Affected >=4.2 <4.2.17, >=5.0 <5.0.10, >=5.1 <5.1.4Fixed in 4.2.17 Fixed in 5.0.10 Fixed in 5.1.4OSV source ↗2 years ago

HighDjango Path Traversal vulnerabilityGHSA-9jmf-237g-qf46BIT-django-2024-39330CVE-2024-39330PYSEC-2024-58Affected >=4.2 <4.2.14, >=5.0 <5.0.7Fixed in 4.2.14 Fixed in 5.0.7OSV source ↗2 years ago

HighDjango vulnerable to Denial of ServiceGHSA-f6f8-9mx6-9mx2BIT-django-2024-39614CVE-2024-39614PYSEC-2024-59Affected >=4.2 <4.2.14, >=5.0 <5.0.7Fixed in 4.2.14 Fixed in 5.0.7OSV source ↗2 years ago

HighDjango vulnerable to Denial of ServiceGHSA-qg2p-9jwr-mmqfBIT-django-2024-38875CVE-2024-38875PYSEC-2024-56Affected >=4.2 <4.2.14, >=5.0 <5.0.7Fixed in 4.2.14 Fixed in 5.0.7OSV source ↗2 years ago

HighDjango potential denial of service vulnerability in UsernameField on WindowsGHSA-qmf9-6jqf-j8fqBIT-django-2023-46695CVE-2023-46695PYSEC-2023-222Affected >=3.2a1 <3.2.23, >=4.1a1 <4.1.13, >=4.2a1 <4.2.7Fixed in 3.2.23 Fixed in 4.1.13 Fixed in 4.2.7OSV source ↗3 years ago

HighDjango has regular expression denial of service vulnerability in EmailValidator/URLValidatorGHSA-jh3w-4vvf-mjgrBIT-django-2023-36053CVE-2023-36053PYSEC-2023-100Affected >=3.2a1 <3.2.20, >=4.0a1 <4.1.10, >=4.2a1 <4.2.3Fixed in 3.2.20 Fixed in 4.1.10 Fixed in 4.2.3OSV source ↗3 years ago

HighResource exhaustion in DjangoGHSA-2hrw-hx67-34x6BIT-django-2023-24580CVE-2023-24580PYSEC-2023-13Affected >=3.2a1 <3.2.18, >=4.0a1 <4.0.10, >=4.1a1 <4.1.7Fixed in 3.2.18 Fixed in 4.0.10 Fixed in 4.1.7OSV source ↗4 years ago

HighDjango contains Uncontrolled Resource Consumption via cached headerGHSA-q2jf-h9jm-m7p4BIT-django-2023-23969CVE-2023-23969PYSEC-2023-12Affected >=3.2a1 <3.2.17, >=4.0a1 <4.0.9, >=4.1a1 <4.1.6Fixed in 3.2.17 Fixed in 4.0.9 Fixed in 4.1.6OSV source ↗4 years ago

HighDjango denial-of-service vulnerability in internationalized URLsGHSA-qrw5-5h28-6cmgBIT-django-2022-41323CVE-2022-41323PYSEC-2022-304Affected >=3.2 <3.2.16, >=4.0 <4.0.8, >=4.1 <4.1.2, ==1.1, 1.2 - 1.2.1, ==1.3, ==1.4, 3.2a1 - 3.2rc1, ==1.0, ==1.7a2Fixed in 3.2.16 Fixed in 4.0.8 Fixed in 4.1.2OSV source ↗4 years ago

HighDjango Image Field Vulnerable to Image Decompression BombsGHSA-59w8-4wm2-4xw8CVE-2012-3443PYSEC-2012-3Affected <1.3.2, >=1.4 <1.4.1Fixed in 1.3.2 Fixed in 1.4.1OSV source ↗4 years ago

HighDjango vulnerable to Improper Restriction of Operations within the Bounds of a Memory BufferGHSA-5h2q-4hrp-v9rrCVE-2012-3444PYSEC-2012-4Affected <1.3.2, >=1.4 <1.4.1Fixed in 1.3.2 Fixed in 1.4.1OSV source ↗4 years ago

HighDjango Allows Arbitrary URL GenerationGHSA-2655-q453-22f9CVE-2012-4520PYSEC-2012-7Affected >=1.3 <1.3.4, >=1.4 <1.4.2, ==1.1, 1.2 - 1.2.1, ==1.0Fixed in 1.3.4 Fixed in 1.4.2OSV source ↗4 years ago

HighDjango Denial of Service Vulnerability in the authentication framework GHSA-4c42-4rxm-x6qfCVE-2013-1443PYSEC-2013-18Affected >=1.4 <1.4.8, >=1.5 <1.5.4Fixed in 1.4.8 Fixed in 1.5.4OSV source ↗4 years ago

HighDenial-of-service possibility in logout() view by filling session storeGHSA-x38m-486c-2wr9CVE-2015-5964PYSEC-2015-23Affected >=1.4 <1.4.22, >=1.7 <1.7.10Fixed in 1.4.22 Fixed in 1.7.10OSV source ↗4 years ago

HighDjango Reuses Cached CSRF TokenGHSA-89hj-xfx5-7q66CVE-2014-0473PYSEC-2014-2Affected <1.4.11, >=1.5 <1.5.6, >=1.6 <1.6.3Fixed in 1.4.11 Fixed in 1.5.6 Fixed in 1.6.3OSV source ↗4 years ago

HighDjango denial of service via empty session record creationGHSA-pgxh-wfw4-jx2vCVE-2015-5963PYSEC-2015-22Affected >=1.4 <1.4.22, >=1.7 <1.7.10, >=1.8 <1.8.4Fixed in 1.4.22 Fixed in 1.7.10 Fixed in 1.8.4OSV source ↗4 years ago

HighDjango Vulnerable to Cache PoisoningGHSA-rm2j-x595-q9cjCVE-2011-4139PYSEC-2011-4Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗4 years ago

HighDjango Might Allow CSRF Requests via URL VerificationGHSA-wxg3-mfph-qg9wCVE-2011-4138PYSEC-2011-3Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗4 years ago

HighDjango Allows Open RedirectsGHSA-vq3h-3q7v-9prwCVE-2014-3730PYSEC-2014-20Affected >=1.4 <1.4.13, >=1.5 <1.5.8, >=1.6 <1.6.5, >=1.7a0 <1.7b4Fixed in 1.4.13 Fixed in 1.5.8 Fixed in 1.6.5 Fixed in 1.7b4OSV source ↗4 years ago

HighDjango Incorrectly Validates URLsGHSA-f7cm-ccfp-3q4rCVE-2014-0480PYSEC-2014-4Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6OSV source ↗4 years ago

HighDjango Denial-of-service possibility with strip_tagsGHSA-j3j3-jrfh-cm2wCVE-2015-2316PYSEC-2015-18Affected >=1.6 <1.6.11, >=1.7 <1.7.7, >=1.8a0 <1.8c1Fixed in 1.6.11 Fixed in 1.7.7 Fixed in 1.8c1OSV source ↗4 years ago

HighDjango denial of service via file upload namingGHSA-296w-6qhq-gf92CVE-2014-0481PYSEC-2014-5Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6OSV source ↗4 years ago

HighDjango Regex Algorithmic Complexity Causes Denial of ServiceGHSA-p6m5-h7pp-v2x5CVE-2009-3695PYSEC-2009-4Affected >=1.0 <1.0.4, >=1.1 <1.1.1Fixed in 1.0.4 Fixed in 1.1.1OSV source ↗5 years ago

HighDjango Admin Media Handler Vulnerable to Directory TraversalGHSA-9xg7-gg9m-rmq9CVE-2009-2659PYSEC-2009-3Affected <1.1Fixed in 0.96.4 Fixed in 1.0.3 Fixed in 1.1OSV source ↗5 years ago

HighDjango cross-site request forgery (CSRF) vulnerabilityGHSA-r5cj-wv24-92p5CVE-2008-3909PYSEC-2008-2Affected <1.1Fixed in 0.91.3 Fixed in 0.95.4 Fixed in 0.96.3 Fixed in 1.1OSV source ↗5 years ago

HighInfinite Loop in DjangoGHSA-6cw3-g6wv-c2xvBIT-django-2022-23833CVE-2022-23833PYSEC-2022-20Affected >=2.2 <2.2.27, >=3.2 <3.2.12, >=4.0 <4.0.2Fixed in 2.2.27 Fixed in 3.2.12 Fixed in 4.0.2OSV source ↗5 years ago

HighDenial-of-service in DjangoGHSA-53qw-q765-4fwwBIT-django-2021-45115CVE-2021-45115PYSEC-2022-1Affected >=2.2a1 <2.2.26, >=3.2a1 <3.2.11, >=4.0a1 <4.0.1Fixed in 2.2.26 Fixed in 3.2.11 Fixed in 4.0.1OSV source ↗5 years ago

HighInformation disclosure in DjangoGHSA-8c5j-9r9f-c6w8BIT-django-2021-45116CVE-2021-45116PYSEC-2022-2Affected >=2.2 <2.2.26, >=3.2 <3.2.11, >=4.0 <4.0.1Fixed in 2.2.26 Fixed in 3.2.11 Fixed in 4.0.1OSV source ↗5 years ago

HighDjango Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks GHSA-p99v-5w3c-jqq9BIT-django-2021-33571CVE-2021-33571PYSEC-2021-99Affected >=2.2a1 <2.2.24, >=3.0a1 <3.1.12, >=3.2a1 <3.2.4Fixed in 2.2.24 Fixed in 3.1.12 Fixed in 3.2.4OSV source ↗5 years ago

HighPath Traversal in DjangoGHSA-rxjp-mfm9-w4wrBIT-django-2021-31542CVE-2021-31542PYSEC-2021-7Affected >=2.2 <2.2.21, >=3.0 <3.1.9, >=3.2 <3.2.1Fixed in 2.2.21 Fixed in 3.1.9 Fixed in 3.2.1OSV source ↗5 years ago

HighDjango Incorrect Default PermissionsGHSA-fr28-569j-53c4BIT-django-2020-24584CVE-2020-24584PYSEC-2020-34Affected >=2.2 <2.2.16, >=3.0 <3.0.10, >=3.1 <3.1.1Fixed in 2.2.16 Fixed in 3.0.10 Fixed in 3.1.1OSV source ↗6 years ago

HighDjango Incorrect Default PermissionsGHSA-m6gj-h9gm-gw44BIT-django-2020-24583CVE-2020-24583PYSEC-2020-33Affected >=2.2a1 <2.2.16, >=3.0a1 <3.0.10, >=3.1a1 <3.1.1Fixed in 2.2.16 Fixed in 3.0.10 Fixed in 3.1.1OSV source ↗6 years ago

HighDjango Denial-of-service in django.utils.text.TruncatorGHSA-c4qh-4vgv-qc6gCVE-2019-14232PYSEC-2019-11Affected >=1.11a1 <1.11.23, >=2.1a1 <2.1.11, >=2.2a1 <2.2.4Fixed in 1.11.23 Fixed in 2.1.11 Fixed in 2.2.4OSV source ↗7 years ago

HighDjango Denial-of-service in strip_tags()GHSA-h5jv-4p7w-64jgCVE-2019-14233PYSEC-2019-12Affected >=1.11a1 <1.11.23, >=2.1a1 <2.1.11, >=2.2a1 <2.2.4Fixed in 1.11.23 Fixed in 2.1.11 Fixed in 2.2.4OSV source ↗7 years ago

HighUncontrolled Recursion in DjangoGHSA-v9qg-3j8p-r63vCVE-2019-14235PYSEC-2019-14Affected >=1.11a1 <1.11.23, >=2.1a1 <2.1.11, >=2.2a1 <2.2.4Fixed in 1.11.23 Fixed in 2.1.11 Fixed in 2.2.4OSV source ↗7 years ago

HighDjango Denial-of-service by filling session storeGHSA-h582-2pch-3xv3CVE-2015-5143PYSEC-2015-20Affected <1.4.21, >=1.5 <1.7.9, >=1.8 <1.8.3Fixed in 1.4.21 Fixed in 1.7.9 Fixed in 1.8.3OSV source ↗7 years ago

HighUncontrolled Memory Consumption in DjangoGHSA-wh4h-v3f2-r2ppCVE-2019-6975PYSEC-2019-18Affected >=1.11 <1.11.19, >=2.0 <2.0.12, >=2.1 <2.1.7Fixed in 1.11.19 Fixed in 2.0.11 Fixed in 2.0.12 Fixed in 2.1.6 Fixed in 2.1.7OSV source ↗8 years ago

HighDjango vulnerable to information leakage in AuthenticationFormGHSA-rf4j-j272-fj86CVE-2018-6188PYSEC-2018-4Affected >=1.11.8 <1.11.10, >=2.0a1 <2.0.2Fixed in 1.11.10 Fixed in 2.0.2OSV source ↗8 years ago

HighDjango CSRF Protection BypassGHSA-crhm-qpjc-cm64CVE-2016-7401PYSEC-2016-3Affected <1.8.15, >=1.9 <1.9.10Fixed in 1.8.15 Fixed in 1.9.10OSV source ↗10 years ago

HighDjango ReDoS in validators.URLValidatorGHSA-cqf7-ff9h-7967CVE-2015-5145PYSEC-2015-21Affected >=1.8a1 <1.8.3Fixed in 1.8.3OSV source ↗11 years ago

HighDjango Vulnerable to HTTP Response Splitting AttackGHSA-q5qw-4364-5hhmCVE-2015-5144PYSEC-2015-10Affected <1.4.21, >=1.5 <1.7.9, >=1.8a1 <1.8.3Fixed in 1.4.21 Fixed in 1.7.9 Fixed in 1.8.3OSV source ↗11 years ago

HighDjango allows user sessions hijacking via an empty string in the session keyGHSA-6wgp-fwfm-mxp3CVE-2015-3982PYSEC-2015-19Affected >=1.8a1 <1.8.2Fixed in 1.8.2OSV source ↗11 years ago

HighDjango database denial-of-service with ModelMultipleChoiceFieldGHSA-6g95-x6cj-mg4vCVE-2015-0222PYSEC-2015-7Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

HighDjango DoS in django.views.static.serveGHSA-jhjg-w2cp-5j44CVE-2015-0221PYSEC-2015-6Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

HighDenial of service in djangoGHSA-3jqw-crqj-w8qwCVE-2011-4137PYSEC-2011-2Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

HighDjango Cross-Site Request Forgery vulnerabilityGHSA-h95j-h2rv-qrg4CVE-2011-4140PYSEC-2011-5Affected <=1.2.7, >=1.3 <=1.3.1, ==1.2.7, ==1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

HighCross-site request forgery in DjangoGHSA-5j2h-h5hg-3wf8CVE-2011-0696PYSEC-2011-10Affected >=1.1 <1.1.4, >=1.2 <1.2.5Fixed in 1.1.4 Fixed in 1.2.5OSV source ↗16 years ago

HighImproper date handling in DjangoGHSA-7wph-fc4w-wqp2CVE-2010-4535PYSEC-2011-9Affected <1.1.3, >=1.2 <1.2.4Fixed in 1.1.3 Fixed in 1.2.4OSV source ↗16 years ago

HighDjango XSS VulnerabilityGHSA-pw27-w7w4-9qc7CVE-2016-2512PYSEC-2016-15Affected <1.8.10, >=1.9a1 <1.9.3Fixed in 1.8.10 Fixed in 1.9.3OSV source ↗11 years ago

HighDjango Vulnerable to Cache PoisoningGHSA-q7q2-qf2q-rw3wCVE-2014-1418PYSEC-2014-19Affected >=1.4 <1.4.13, >=1.5 <1.5.8, >=1.6 <1.6.5, >=1.7a0 <1.7b4Fixed in 1.4.13 Fixed in 1.5.8 Fixed in 1.6.5 Fixed in 1.7b4OSV source ↗12 years ago

HighPotential bypass of an upstream access control based on URL paths in DjangoGHSA-v6rh-hp5x-86rvBIT-django-2021-44420CVE-2021-44420PYSEC-2021-439Affected >=2.2a1 <2.2.25, >=3.0a1 <3.1.14, >=3.2a1 <3.2.10Fixed in 2.2.25 Fixed in 3.1.14 Fixed in 3.2.10OSV source ↗5 years ago

HighDjango vulnerable to SQL injection in column aliasesGHSA-hpr9-3m2g-3j9pBIT-django-2025-59681CVE-2025-59681PYSEC-2025-106Affected >=4.2 <4.2.25, >=5.1 <5.1.13, >=5.2 <5.2.7Fixed in 4.2.25 Fixed in 5.1.13 Fixed in 5.2.7OSV source ↗last year

HighDjango is subject to SQL injection through its column aliasesGHSA-6w2r-r2m5-xq5wBIT-django-2025-57833CVE-2025-57833PYSEC-2025-105Affected <4.2.24, >=5.0a1 <5.1.12, >=5.2a1 <5.2.6Fixed in 4.2.24 Fixed in 5.1.12 Fixed in 5.2.6OSV source ↗last year

MediumDjango Middleware Enables Session HijackingGHSA-625g-gx8c-xcmgCVE-2014-0482PYSEC-2014-6Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6, >=1.7a1 <1.7c3Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6 Fixed in 1.7c3OSV source ↗4 years ago

MediumDjango allows unintended model editingGHSA-hvmf-r92r-27hrCVE-2019-19118PYSEC-2019-15Affected >=2.1 <2.1.15, >=2.2 <2.2.8Fixed in 2.1.15 Fixed in 2.2.8OSV source ↗7 years ago

MediumImproper Input Validation in DjangoGHSA-337x-4q8g-prc5CVE-2019-3498PYSEC-2019-17Affected >=1.11a1 <1.11.18, >=2.0a1 <2.0.10, >=2.1a1 <2.1.5Fixed in 1.11.18 Fixed in 2.0.10 Fixed in 2.1.5OSV source ↗8 years ago

MediumImproper query string handling in DjangoGHSA-fwr5-q9rx-294fCVE-2010-4534PYSEC-2011-8Affected <1.1.3, >=1.2 <1.2.4Fixed in 1.1.3 Fixed in 1.2.4OSV source ↗16 years ago

MediumXSS in jQuery as used in Drupal, Backdrop CMS, and other productsGHSA-6c3j-c64m-qhgqCVE-2019-11358DRUPAL-CORE-2019-006PYSEC-2026-628SNYK-JS-JQUERY-174006Affected >=2.0a1 <2.1.9, >=2.2a1 <2.2.2Fixed in 2.1.9 Fixed in 2.2.2OSV source ↗4 months ago

MediumDjango Allows Redirect via Data URLGHSA-78vx-ggch-wghmCVE-2012-3442PYSEC-2012-2Affected <1.3.2, >=1.4 <1.4.1Fixed in 1.3.2 Fixed in 1.4.1OSV source ↗4 years ago

MediumDjango cross-site scripting (XSS) attack via user-supplied redirect URLsGHSA-7fq8-4pv5-5w5cCVE-2015-2317PYSEC-2015-9Affected <1.4.20, >=1.5 <1.6.11, >=1.7 <1.7.7, >=1.8a0 <1.8c1Fixed in 1.4.20 Fixed in 1.6.11 Fixed in 1.7.7 Fixed in 1.8c1OSV source ↗4 years ago

MediumDjango Cross-site scripting (XSS) vulnerabilityGHSA-54qj-48vx-cr9fCVE-2008-2302PYSEC-2008-1Affected <1.1Fixed in 0.91.2 Fixed in 0.95.3 Fixed in 0.96.2 Fixed in 1.1OSV source ↗5 years ago

MediumCross-site Scripting in DjangoGHSA-95rw-fx8r-36v6BIT-django-2022-22818CVE-2022-22818PYSEC-2022-19Affected >=2.2 <2.2.27, >=3.2 <3.2.12, >=4.0 <4.0.2Fixed in 2.2.27 Fixed in 3.2.12 Fixed in 4.0.2OSV source ↗5 years ago

MediumHeader injection possible in DjangoGHSA-qm57-vhq3-3fwfBIT-django-2021-32052CVE-2021-32052PYSEC-2021-8Affected >=2.2 <2.2.22, >=3.1 <3.1.10, >=3.2 <3.2.2Fixed in 2.2.22 Fixed in 3.1.10 Fixed in 3.2.2OSV source ↗6 years ago