Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 167

Export CSV
CVE-2024-39329

python-django: Username enumeration through timing difference for users with unusable passwords

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2024-38875

python-django: Potential denial-of-service in django.utils.html.urlize()

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2025-48432

django: Django Path Injection Vulnerability

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Djangoproject
Products
Debian Linux Django
CVE-2025-27556

django: Django DoS Unicode Attack

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 5.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Djangoproject Microsoft
Products
Django Windows
CVE-2024-56374

django: potential denial-of-service vulnerability in IPv6 validation

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

CVSS 3.1 · 5.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Ansible Automation Platform and 3 more
CVE-2025-26699

django: Potential denial-of-service vulnerability in django.utils.text.wrap()

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Ansible Automation Platform and 1 more
CVE-2025-32873

django: Django StripTags Denial of Service

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

CVSS 3.1 · 5.3 Medium EPSS 14.3% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2024-53907

django: Potential denial-of-service in django.utils.html.strip_tags()

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Ansible Automation Platform Developer and 1 more
CVE-2024-53908

django: Potential SQL injection in HasKey(lhs, rhs) on Oracle

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform
CVE-2021-45116

django: Potential information disclosure in dictsort template filter

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Satellite and 1 more
CVE-2022-41323

python-django: Potential denial-of-service vulnerability in internationalized URLs

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Rhui Satellite and 1 more
CVE-2017-7234

python-django: Open redirect vulnerability in django.views.static.serve()

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2017-7233

python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

CVSS 3.0 · 6.1 Medium EPSS 2.4% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Openstack Satellite and 1 more
CVE-2017-12794

python-django: Possible XSS in traceback section of technical 500 debug page

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

CVSS 3.0 · 6.1 Medium EPSS 23.6% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2014-1418

Django: cached data possibly served to the wrong session

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.

CVSS 2.0 · 6.4 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Djangoproject
Products
Ubuntu Linux Django
CVE-2014-0483

Django: data leakage via querystring manipulation in admin

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.

CVSS 2.0 · 3.5 Low EPSS 2.0% KEV · Not listed
Vendors
Djangoproject Opensuse
Products
Django Opensuse
CVE-2014-0482

Django: RemoteUserMiddleware session hijacking

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.

CVSS 2.0 · 6.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Djangoproject Opensuse
Products
Django Opensuse
CVE-2014-0481

Django: file upload denial of service

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Djangoproject Opensuse and 1 more
Products
Debian Linux Django Opensuse and 1 more
CVE-2014-0480

Django: reverse() can generate URLs pointing to other hosts, leading to phishing attacks

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.

CVSS 2.0 · 5.8 Medium EPSS 2.3% KEV · Not listed
Vendors
Djangoproject Opensuse
Products
Django Opensuse
CVE-2016-9014

python-django: DNS rebinding vulnerability when 'DEBUG=True'

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

CVSS 3.0 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Canonical Djangoproject Fedoraproject
Products
Ubuntu Linux Django Fedora