.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

django 5.0.3 vulnerabilities

162 advisories known · django@5.0.3 · 27 affect this release · Dependencies not checked · showing 62 more

SEVERITYADVISORYPUBLISHED

Does not affect 5.0.3

SEVERITYADVISORYPUBLISHED

MediumImproper Input Validation in DjangoGHSA-337x-4q8g-prc5CVE-2019-3498PYSEC-2019-17Affected >=1.11a1 <1.11.18, >=2.0a1 <2.0.10, >=2.1a1 <2.1.5Fixed in 1.11.18 Fixed in 2.0.10 Fixed in 2.1.5OSV source ↗8 years ago

MediumImproper query string handling in DjangoGHSA-fwr5-q9rx-294fCVE-2010-4534PYSEC-2011-8Affected <1.1.3, >=1.2 <1.2.4Fixed in 1.1.3 Fixed in 1.2.4OSV source ↗16 years ago

MediumXSS in jQuery as used in Drupal, Backdrop CMS, and other productsGHSA-6c3j-c64m-qhgqCVE-2019-11358DRUPAL-CORE-2019-006PYSEC-2026-628SNYK-JS-JQUERY-174006Affected >=2.0a1 <2.1.9, >=2.2a1 <2.2.2Fixed in 2.1.9 Fixed in 2.2.2OSV source ↗4 months ago

MediumDjango Allows Redirect via Data URLGHSA-78vx-ggch-wghmCVE-2012-3442PYSEC-2012-2Affected <1.3.2, >=1.4 <1.4.1Fixed in 1.3.2 Fixed in 1.4.1OSV source ↗4 years ago

MediumDjango cross-site scripting (XSS) attack via user-supplied redirect URLsGHSA-7fq8-4pv5-5w5cCVE-2015-2317PYSEC-2015-9Affected <1.4.20, >=1.5 <1.6.11, >=1.7 <1.7.7, >=1.8a0 <1.8c1Fixed in 1.4.20 Fixed in 1.6.11 Fixed in 1.7.7 Fixed in 1.8c1OSV source ↗4 years ago

MediumDjango Cross-site scripting (XSS) vulnerabilityGHSA-54qj-48vx-cr9fCVE-2008-2302PYSEC-2008-1Affected <1.1Fixed in 0.91.2 Fixed in 0.95.3 Fixed in 0.96.2 Fixed in 1.1OSV source ↗5 years ago

MediumCross-site Scripting in DjangoGHSA-95rw-fx8r-36v6BIT-django-2022-22818CVE-2022-22818PYSEC-2022-19Affected >=2.2 <2.2.27, >=3.2 <3.2.12, >=4.0 <4.0.2Fixed in 2.2.27 Fixed in 3.2.12 Fixed in 4.0.2OSV source ↗5 years ago

MediumHeader injection possible in DjangoGHSA-qm57-vhq3-3fwfBIT-django-2021-32052CVE-2021-32052PYSEC-2021-8Affected >=2.2 <2.2.22, >=3.1 <3.1.10, >=3.2 <3.2.2Fixed in 2.2.22 Fixed in 3.1.10 Fixed in 3.2.2OSV source ↗6 years ago

MediumXSS in DjangoGHSA-2m34-jcjv-45xfBIT-django-2020-13596CVE-2020-13596PYSEC-2020-32Affected >=2.2a1 <2.2.13, >=3.0a1 <3.0.7Fixed in 2.2.13 Fixed in 3.0.7OSV source ↗6 years ago

MediumDjango Cross-site Scripting in AdminURLFieldWidgetGHSA-7rp2-fm2h-wchjCVE-2019-12308PYSEC-2019-79Affected >=1.11a1 <1.11.21, >=2.1a1 <2.1.9, >=2.2a1 <2.2.2Fixed in 1.11.21 Fixed in 2.1.9 Fixed in 2.2.2OSV source ↗7 years ago

MediumDjango vulnerable to XSS on 500 pagesGHSA-9r8w-6x8c-6jr9CVE-2017-12794PYSEC-2017-44Affected >=1.10a1 <1.10.8, >=1.11a1 <1.11.5Fixed in 1.10.8 Fixed in 1.11.5OSV source ↗8 years ago

MediumDjango open redirect and possible XSS attack via user-supplied numeric redirect URLsGHSA-37hp-765x-j95xCVE-2017-7233PYSEC-2017-9Affected >=1.10a1 <1.10.7, >=1.8a1 <1.8.18, >=1.9a1 <1.9.13Fixed in 1.10.7 Fixed in 1.8.18 Fixed in 1.9.13OSV source ↗8 years ago

MediumDjango open redirectGHSA-h4hv-m4h4-mhwgCVE-2017-7234PYSEC-2017-10Affected >=1.10 <1.10.7, >=1.8 <1.8.18, >=1.9 <1.9.13Fixed in 1.10.7 Fixed in 1.8.18 Fixed in 1.9.13OSV source ↗8 years ago

MediumDjango open redirectGHSA-5hg3-6c2f-f3wrCVE-2018-14574PYSEC-2018-2Affected >=1.11 <1.11.15, >=2.0 <2.0.8Fixed in 1.11.15 Fixed in 2.0.8OSV source ↗8 years ago

MediumDjango Cross-site scripting VulnerabilityGHSA-c8c8-9472-w52hCVE-2016-6186PYSEC-2016-2Affected <1.8.14, >=1.10a0 <1.10rc1, >=1.9 <1.9.8, 1.9a1 - 1.9rc2Fixed in 1.10rc1 Fixed in 1.8.14 Fixed in 1.9.8OSV source ↗10 years ago

MediumDjango Cross-site Scripting VulnerabilityGHSA-6565-fg86-6jcxCVE-2015-2241PYSEC-2015-8Affected <1.7.6, >=1.8a1 <1.8b2Fixed in 1.7.6 Fixed in 1.8b2OSV source ↗12 years ago

MediumDjango Cross-site Scripting VulnerabilityGHSA-gv98-g628-m9x5CVE-2015-0220PYSEC-2015-5Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

MediumDjango cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widgetGHSA-4894-5vqc-6r2rCVE-2013-4249PYSEC-2013-19Affected >=1.5 <1.5.2, ==1.1, 1.2 - 1.2.1, ==1.3, ==1.4, ==1.0, ==1.5a1, ==1.5b1, ==1.5b2, ==1.5c1+1 more ranges Fixed in 1.5.2OSV source ↗13 years ago

MediumDjango cross-site scripting (XSS) vulnerability via is_safe_url function GHSA-9cwg-mhxf-hh59CVE-2013-6044PYSEC-2013-21Affected >=1.4 <1.4.6, >=1.5 <1.5.2, ==1.1, 1.2 - 1.2.1, ==1.3, ==1.0, ==1.5a1, ==1.5b1, ==1.5b2, ==1.5c1+1 more ranges Fixed in 1.4.6 Fixed in 1.5.2OSV source ↗13 years ago

MediumCross-site scripting in djangoGHSA-8m3r-rv5g-fcpqCVE-2011-0697PYSEC-2011-11Affected >=1.1 <1.1.4, >=1.2 <1.2.5Fixed in 1.1.4 Fixed in 1.2.5OSV source ↗16 years ago

MediumCross-site scripting in djangoGHSA-fxpg-gg9g-76gjCVE-2010-3082PYSEC-2010-12Affected >=1.2 <1.2.2Fixed in 1.2.2OSV source ↗16 years ago

MediumXML Entity Expansion (XEE) in DjangoGHSA-qrh7-x6fp-c2mpCVE-2013-1664PYSEC-2026-801Affected >=1.3.0 <1.3.6, >=1.4.0 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗4 months ago

MediumXML External Entity (XXE) in DjangoGHSA-x64m-686f-fmm3CVE-2013-1665PYSEC-2026-802Affected >=1.3.0 <1.3.6, >=1.4.0 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗4 months ago

MediumDjango is vulnerable to DoS via XML serializer text extractionGHSA-vrcr-9hj9-jcg6BIT-django-2025-64460CVE-2025-64460PYSEC-2025-109Affected >=4.2a1 <4.2.27, >=5.1a1 <5.1.15, >=5.2a1 <5.2.9Fixed in 4.2.27 Fixed in 5.1.15 Fixed in 5.2.9OSV source ↗11 months ago

MediumDjango Improper Access ControlGHSA-mwv2-398h-v489CVE-2007-0405PYSEC-2026-629Affected >=0.95 <1.0Fixed in 1.0OSV source ↗5 years ago

MediumDjango denial-of-service attack in the intcomma template filterGHSA-xxj9-f6rv-m3x4BIT-django-2024-24680CVE-2024-24680PYSEC-2024-28Affected >=3.2 <3.2.24, >=4.2 <4.2.10, >=5.0 <5.0.2Fixed in 3.2.24 Fixed in 4.2.10 Fixed in 5.0.2OSV source ↗3 years ago

MediumDjango Denial-of-service in django.utils.text.TruncatorGHSA-h8gc-pgj2-vjm3BIT-django-2023-43665CVE-2023-43665PYSEC-2023-226Affected >=3.2a1 <3.2.22, >=4.1a1 <4.1.12, >=4.2a1 <4.2.6Fixed in 3.2.22 Fixed in 4.1.12 Fixed in 4.2.6OSV source ↗3 years ago

MediumDjango vulnerable to Denial of Service via i18n middleware componentGHSA-9v8h-57gv-qch6CVE-2007-5712PYSEC-2007-1Affected <1.1Fixed in 0.91.1 Fixed in 0.95.2 Fixed in 0.96.1 Fixed in 1.1OSV source ↗5 years ago

MediumData leakage via cache key collision in DjangoGHSA-wpjr-j57x-wxfwBIT-django-2020-13254CVE-2020-13254PYSEC-2020-31Affected >=2.2 <2.2.13, >=3.0 <3.0.7Fixed in 2.2.13 Fixed in 3.0.7OSV source ↗6 years ago

MediumDjango Access Restrictions Bypass GHSA-46x4-9jmv-jc8pCVE-2016-2048PYSEC-2016-14Affected >=1.9 <1.9.2Fixed in 1.9.2OSV source ↗11 years ago

MediumDjango has an SQL Injection issueGHSA-6426-9fv3-65x8BIT-django-2026-1312CVE-2026-1312PYSEC-2026-47Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

MediumDjango has an Improper Handling of Length Parameter InconsistencyGHSA-w26r-rmm8-9c29BIT-django-2026-5766CVE-2026-5766PYSEC-2026-54Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

MediumDjango has a denial-of-service possibility in strip_tags()GHSA-8j24-cjrq-gr2mBIT-django-2025-32873CVE-2025-32873PYSEC-2025-37Affected >=4.2 <4.2.21, >=5.1 <5.1.9, >=5.2 <5.2.1Fixed in 4.2.21 Fixed in 5.1.9 Fixed in 5.2.1OSV source ↗2 years ago

MediumRegular expression denial-of-service in DjangoGHSA-vm8q-m57g-pff3BIT-django-2024-27351CVE-2024-27351PYSEC-2024-47Affected >=3.2 <3.2.25, >=4.2 <4.2.11, >=5.0 <5.0.3Fixed in 3.2.25 Fixed in 4.2.11 Fixed in 5.0.3OSV source ↗3 years ago

MediumDjango Denial of service vulnerability in django.utils.encoding.uri_to_iriGHSA-7h4p-27mh-hmrwBIT-django-2023-41164CVE-2023-41164PYSEC-2023-225Affected >=3.2 <3.2.21, >=4.1 <4.1.11, >=4.2 <4.2.5Fixed in 3.2.21 Fixed in 4.1.11 Fixed in 4.2.5OSV source ↗3 years ago

MediumDjango data leakage via querystring manipulation in adminGHSA-rw75-m7gp-92m3CVE-2014-0483PYSEC-2014-7Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6, >=1.7a1 <1.7c3Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6 Fixed in 1.7c3OSV source ↗4 years ago

MediumDirectory-traversal in DjangoGHSA-jrh2-hc4r-7jwxBIT-django-2021-45452CVE-2021-45452PYSEC-2022-3Affected >=2.2 <2.2.26, >=3.2 <3.2.11, >=4.0 <4.0.1Fixed in 2.2.26 Fixed in 3.2.11 Fixed in 4.0.1OSV source ↗5 years ago

MediumDirectory Traversal in DjangoGHSA-xgxc-v2qg-chmhBIT-django-2021-28658CVE-2021-28658PYSEC-2021-6Affected >=2.2a1 <2.2.20, >=3.0a1 <3.0.14, >=3.1a1 <3.1.8Fixed in 2.2.20 Fixed in 3.0.14 Fixed in 3.1.8OSV source ↗6 years ago

MediumDjango Directory Traversal via archive.extractGHSA-fvgf-6h6h-3322BIT-django-2021-3281CVE-2021-3281PYSEC-2021-9Affected >=2.2 <2.2.18, >=3.0 <3.0.12, >=3.1 <3.1.6Fixed in 2.2.18 Fixed in 3.0.12 Fixed in 3.1.6OSV source ↗6 years ago

MediumDjango Incorrect HTTP detection with reverse-proxy connecting via HTTPSGHSA-6c7v-2f49-8h26CVE-2019-12781PYSEC-2019-10Affected >=1.11 <1.11.22, >=2.1 <2.1.10, >=2.2 <2.2.3Fixed in 1.11.22 Fixed in 2.1.10 Fixed in 2.2.3OSV source ↗7 years ago

MediumDjango denial-of-service possibility in urlize and urlizetrunc template filtersGHSA-r28v-mw67-m5p9CVE-2018-7536PYSEC-2018-5Affected >=1.11a1 <1.11.11, >=1.8a1 <1.8.19, >=2.0a1 <2.0.3Fixed in 1.11.11 Fixed in 1.8.19 Fixed in 2.0.3OSV source ↗8 years ago

MediumDjango Denial-of-service possibility in truncatechars_html and truncatewords_html template filtersGHSA-2f9x-5v75-3qv4CVE-2018-7537PYSEC-2018-6Affected >=1.11 <1.11.11, >=1.8 <1.8.19, >=2.0 <2.0.3Fixed in 1.11.11 Fixed in 1.8.19 Fixed in 2.0.3OSV source ↗8 years ago

MediumDjango WSGI Header Spoofing VulnerabilityGHSA-7qfw-j7hp-v45gCVE-2015-0219PYSEC-2015-4Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

MediumDjango is vulnerable to Denial of Service attack in formset GHSA-g8xg-jgj6-49r3CVE-2013-0306PYSEC-2013-17Affected >=1.3 <1.3.6, >=1.4 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗14 years ago

MediumPath Traversal in DjangoGHSA-68w8-qjq3-2gfmBIT-django-2021-33203CVE-2021-33203PYSEC-2021-98Affected <2.2.24, >=3.0 <3.1.12, >=3.2 <3.2.4Fixed in 2.2.24 Fixed in 3.1.12 Fixed in 3.2.4OSV source ↗5 years ago

MediumDjango allows unprivileged users to read the password hashes of arbitrary accountsGHSA-6mx3-3vqg-hpp2CVE-2018-16984PYSEC-2018-3Affected >=2.1 <2.1.2Fixed in 2.1.2OSV source ↗8 years ago

MediumDjango Uses Cache Containing Sensitive InformationGHSA-5hrc-gvxj-w55pBIT-django-2026-6907CVE-2026-6907PYSEC-2026-55Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

MediumDjango is vulnerable to SQL injection in column aliasesGHSA-rqw2-ghq9-44m7BIT-django-2025-13372CVE-2025-13372PYSEC-2025-104Affected >=4.2a1 <4.2.27, >=5.1a1 <5.1.15, >=5.2a1 <5.2.9Fixed in 4.2.27 Fixed in 5.1.15 Fixed in 5.2.9OSV source ↗11 months ago

MediumDjango Data leakage via admin history logGHSA-r7w6-p47g-vj53CVE-2013-0305PYSEC-2013-16Affected >=1.3 <1.3.6, >=1.4 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗14 years ago

MediumSession manipulation in DjangoGHSA-x88j-93vc-wpmpCVE-2011-4136PYSEC-2011-1Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

LowDjango has a Race Condition vulnerabilityGHSA-mjgh-79qc-68w3BIT-django-2026-25674CVE-2026-25674PYSEC-2026-2449Affected >=4.2 <4.2.29, >=5.2 <5.2.12, >=6.0 <6.0.3Fixed in 4.2.29 Fixed in 5.2.12 Fixed in 6.0.3OSV source ↗8 months ago

LowDjango fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshakeGHSA-mm6v-q8q9-pgcfBIT-django-2026-7666CVE-2026-7666PYSEC-2026-200Affected >=5.2 <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from VaryGHSA-qpc8-7fxc-cm4pBIT-django-2026-35193CVE-2026-35193PYSEC-2026-197Affected >=5.2 <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango vulnerable to partial directory traversal via archivesGHSA-q95w-c7qg-hrffBIT-django-2025-59682CVE-2025-59682PYSEC-2026-1296Affected >=4.2 <4.2.25, >=5.1 <5.1.13, >=5.2 <5.2.7Fixed in 4.2.25 Fixed in 5.1.13 Fixed in 5.2.7OSV source ↗last year

LowDjango User Enumeration VulnerabilityGHSA-fp6p-5xvw-m74fCVE-2016-2513PYSEC-2016-16Affected <1.8.10, >=1.9 <1.9.3Fixed in 1.8.10 Fixed in 1.9.3OSV source ↗11 years ago

LowDjango Uses Persistent Cookies Containing Sensitive Information GHSA-7h2m-m8vj-598hBIT-django-2026-35192CVE-2026-35192PYSEC-2026-50Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

LowDjango vulnerable to privilege abuse in GenericInlineModelAdminGHSA-pwjp-ccjc-ghwgBIT-django-2026-4277CVE-2026-4277PYSEC-2026-52Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago

LowDjango has Inefficient Algorithmic ComplexityGHSA-4rrr-2h4v-f3j9BIT-django-2026-1285CVE-2026-1285PYSEC-2026-45Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

LowDjango has Observable Timing DiscrepancyGHSA-2mcm-79hx-8fxwBIT-django-2025-13473CVE-2025-13473PYSEC-2026-42Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

LowDjango has Inefficient Algorithmic ComplexityGHSA-33mw-q7rj-mjwjBIT-django-2025-14550CVE-2025-14550PYSEC-2026-43Affected >=4.2a1 <4.2.28, >=5.2a1 <5.2.11, >=6.0a1 <6.0.2Fixed in 4.2.28 Fixed in 5.2.11 Fixed in 6.0.2OSV source ↗9 months ago

LowDjango settings leak in date template filterGHSA-6wcr-wcqm-3mfhCVE-2015-8213PYSEC-2015-11Affected <1.7.11, >=1.8a1 <1.8.7, >=1.9a0 <1.9rc2Fixed in 1.7.11 Fixed in 1.8.7 Fixed in 1.9rc2OSV source ↗11 years ago

LowDjango vulnerable to privilege abuse in ModelAdmin.list_editableGHSA-mmwr-2jhp-mc7jBIT-django-2026-4292CVE-2026-4292PYSEC-2026-53Affected >=4.2 <4.2.30, >=5.2 <5.2.13, >=6.0 <6.0.4Fixed in 4.2.30 Fixed in 5.2.13 Fixed in 6.0.4OSV source ↗7 months ago