Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "RED"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Generated from an analysis of SBOM cdx_cdxgen_django-jenkins.json (cyclonedx-json, sha256 dc5969125835c58ab1349e03580d1b4a20ba8103f0145cfb712e154c0fea0b2a)."
},
{
"category": "general",
"text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: shieldbom (fail).",
"title": "Analysis coverage"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory",
"url": "https://ndaal.eu/csaf/ndaal-sba-draft-dc5969125835c58a"
}
],
"title": "Vulnerabilities found in SBOM cdx_cdxgen_django-jenkins.json",
"tracking": {
"current_release_date": "2026-10-10T05:28:19Z",
"generator": {
"engine": {
"name": "ndaal SBOM Auditor",
"version": "1.6.34"
}
},
"id": "ndaal-sba-draft-dc5969125835c58a",
"initial_release_date": "2026-10-10T05:28:19Z",
"revision_history": [
{
"date": "2026-10-10T05:28:19Z",
"number": "0.1.0",
"summary": "Initial draft generated from an SBOM analysis."
}
],
"status": "draft",
"version": "0.1.0"
}
},
"product_tree": {
"full_product_names": [
{
"name": "Django@5.1.2",
"product_id": "CSAFPID-0001"
},
{
"name": "django@5.1.2",
"product_id": "CSAFPID-0003"
},
{
"name": "sqlparse@0.5.1",
"product_id": "CSAFPID-0002"
},
{
"name": "unknown",
"product_id": "CSAFPID-0004"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-3695",
"notes": [
{
"category": "description",
"text": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2009-3695",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2009-3695"
}
]
},
{
"cve": "CVE-2010-3082",
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2010-3082",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2010-3082"
}
]
},
{
"cve": "CVE-2010-4534",
"notes": [
{
"category": "description",
"text": "The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2010-4534",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2010-4534"
}
]
},
{
"cve": "CVE-2010-4535",
"notes": [
{
"category": "description",
"text": "The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2010-4535",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2010-4535"
}
]
},
{
"cve": "CVE-2011-0696",
"notes": [
{
"category": "description",
"text": "Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a \"combination of browser plugins and redirects,\" a related issue to CVE-2011-0447."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-0696",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-0696"
}
]
},
{
"cve": "CVE-2011-0697",
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-0697",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-0697"
}
]
},
{
"cve": "CVE-2011-0698",
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-0698",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-0698"
}
]
},
{
"cve": "CVE-2011-4136",
"notes": [
{
"category": "description",
"text": "django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-4136",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-4136"
}
]
},
{
"cve": "CVE-2011-4137",
"notes": [
{
"category": "description",
"text": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-4137",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-4137"
}
]
},
{
"cve": "CVE-2011-4138",
"notes": [
{
"category": "description",
"text": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-4138",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-4138"
}
]
},
{
"cve": "CVE-2011-4139",
"notes": [
{
"category": "description",
"text": "Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-4139",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-4139"
}
]
},
{
"cve": "CVE-2011-4140",
"notes": [
{
"category": "description",
"text": "Django Cross-Site Request Forgery vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2011-4140",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2011-4140"
}
]
},
{
"cve": "CVE-2012-3442",
"notes": [
{
"category": "description",
"text": "The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2012-3442",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2012-3442"
}
]
},
{
"cve": "CVE-2012-3443",
"notes": [
{
"category": "description",
"text": "The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2012-3443",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2012-3443"
}
]
},
{
"cve": "CVE-2012-3444",
"notes": [
{
"category": "description",
"text": "The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2012-3444",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2012-3444"
}
]
},
{
"cve": "CVE-2012-4520",
"notes": [
{
"category": "description",
"text": "The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2012-4520",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2012-4520"
}
]
},
{
"cve": "CVE-2013-0305",
"notes": [
{
"category": "description",
"text": "The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-0305",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-0305"
}
]
},
{
"cve": "CVE-2013-0306",
"notes": [
{
"category": "description",
"text": "The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-0306",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-0306"
}
]
},
{
"cve": "CVE-2013-1443",
"notes": [
{
"category": "description",
"text": "The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-1443",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-1443"
}
]
},
{
"cve": "CVE-2013-4249",
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-4249",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-4249"
}
]
},
{
"cve": "CVE-2013-4315",
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-4315",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-4315"
}
]
},
{
"cve": "CVE-2013-6044",
"notes": [
{
"category": "description",
"text": "The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by \"the login view in django.contrib.auth.views\" and the javascript: scheme."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2013-6044",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2013-6044"
}
]
},
{
"cve": "CVE-2014-0472",
"notes": [
{
"category": "description",
"text": "The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a \"dotted Python path.\""
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0472",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0472"
}
]
},
{
"cve": "CVE-2014-0473",
"notes": [
{
"category": "description",
"text": "The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0473",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0473"
}
]
},
{
"cve": "CVE-2014-0474",
"notes": [
{
"category": "description",
"text": "The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to \"MySQL typecasting.\""
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0474",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0474"
}
]
},
{
"cve": "CVE-2014-0480",
"notes": [
{
"category": "description",
"text": "The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0480",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0480"
}
]
},
{
"cve": "CVE-2014-0481",
"notes": [
{
"category": "description",
"text": "The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0481",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0481"
}
]
},
{
"cve": "CVE-2014-0482",
"notes": [
{
"category": "description",
"text": "The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0482",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0482"
}
]
},
{
"cve": "CVE-2014-0483",
"notes": [
{
"category": "description",
"text": "The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-0483",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-0483"
}
]
},
{
"cve": "CVE-2014-1418",
"notes": [
{
"category": "description",
"text": "Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-1418",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-1418"
}
]
},
{
"cve": "CVE-2014-3730",
"notes": [
{
"category": "description",
"text": "The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by \"http:\\\\\\djangoproject.com.\""
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2014-3730",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2014-3730"
}
]
},
{
"cve": "CVE-2015-0219",
"notes": [
{
"category": "description",
"text": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-0219",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-0219"
}
]
},
{
"cve": "CVE-2015-0220",
"notes": [
{
"category": "description",
"text": "The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \"\\njavascript:\" URL."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-0220",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-0220"
}
]
},
{
"cve": "CVE-2015-0221",
"notes": [
{
"category": "description",
"text": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-0221",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-0221"
}
]
},
{
"cve": "CVE-2015-0222",
"notes": [
{
"category": "description",
"text": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-0222",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-0222"
}
]
},
{
"cve": "CVE-2015-2241",
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-2241",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-2241"
}
]
},
{
"cve": "CVE-2015-2316",
"notes": [
{
"category": "description",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-2316",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-2316"
}
]
},
{
"cve": "CVE-2015-2317",
"notes": [
{
"category": "description",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-2317",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-2317"
}
]
},
{
"cve": "CVE-2015-3982",
"notes": [
{
"category": "description",
"text": "The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-3982",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-3982"
}
]
},
{
"cve": "CVE-2015-5143",
"notes": [
{
"category": "description",
"text": "The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-5143",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-5143"
}
]
},
{
"cve": "CVE-2015-5144",
"notes": [
{
"category": "description",
"text": "Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-5144",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-5144"
}
]
},
{
"cve": "CVE-2015-5145",
"notes": [
{
"category": "description",
"text": "validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-5145",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-5145"
}
]
},
{
"cve": "CVE-2015-5963",
"notes": [
{
"category": "description",
"text": "contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-5963",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-5963"
}
]
},
{
"cve": "CVE-2015-5964",
"notes": [
{
"category": "description",
"text": "The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-5964",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-5964"
}
]
},
{
"cve": "CVE-2015-8213",
"notes": [
{
"category": "description",
"text": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2015-8213",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2015-8213"
}
]
},
{
"cve": "CVE-2016-2048",
"notes": [
{
"category": "description",
"text": "Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the \"Save as New\" option when editing objects and leveraging the \"change\" permission."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-2048",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-2048"
}
]
},
{
"cve": "CVE-2016-2512",
"notes": [
{
"category": "description",
"text": "The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-2512",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-2512"
}
]
},
{
"cve": "CVE-2016-2513",
"notes": [
{
"category": "description",
"text": "The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-2513",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-2513"
}
]
},
{
"cve": "CVE-2016-6186",
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-6186",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-6186"
}
]
},
{
"cve": "CVE-2016-7401",
"notes": [
{
"category": "description",
"text": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-7401",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-7401"
}
]
},
{
"cve": "CVE-2016-9013",
"notes": [
{
"category": "description",
"text": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-9013",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-9013"
}
]
},
{
"cve": "CVE-2016-9014",
"notes": [
{
"category": "description",
"text": "Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2016-9014",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2016-9014"
}
]
},
{
"cve": "CVE-2017-12794",
"notes": [
{
"category": "description",
"text": "In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with \"DEBUG = True\" (which makes this page accessible) in your production settings."
},
{
"category": "other",
"text": "A public nuclei exploit template exists (severity: medium).",
"title": "Nuclei template"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2017-12794",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2017-12794"
}
]
},
{
"cve": "CVE-2017-7233",
"notes": [
{
"category": "description",
"text": "Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2017-7233",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2017-7233"
}
]
},
{
"cve": "CVE-2017-7234",
"notes": [
{
"category": "description",
"text": "A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2017-7234",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2017-7234"
}
]
},
{
"cve": "CVE-2018-6188",
"notes": [
{
"category": "description",
"text": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2018-6188",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2018-6188"
}
]
},
{
"cve": "CVE-2019-19844",
"notes": [
{
"category": "description",
"text": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2019-19844",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2019-19844"
}
]
},
{
"cve": "CVE-2023-31047",
"notes": [
{
"category": "description",
"text": "In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's \"Uploading multiple files\" documentation suggested otherwise."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2023-31047",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-31047"
}
]
},
{
"cve": "CVE-2024-45230",
"notes": [
{
"category": "description",
"text": "An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2024-45230",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-45230"
}
]
},
{
"cve": "CVE-2024-45231",
"notes": [
{
"category": "description",
"text": "An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing)."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0004"
]
}
],
"title": "CVE-2024-45231",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-45231"
}
]
},
{
"cve": "CVE-2024-53907",
"notes": [
{
"category": "description",
"text": "Django denial-of-service in django.utils.html.strip_tags()"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.4 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-8498-2h75-472j",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-53907"
}
]
},
{
"cve": "CVE-2024-53908",
"notes": [
{
"category": "description",
"text": "Django SQL injection in HasKey(lhs, rhs) on Oracle"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.4 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-m9g8-fxxm-xg86",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-53908"
}
]
},
{
"cve": "CVE-2024-56374",
"notes": [
{
"category": "description",
"text": "Django has a potential denial-of-service vulnerability in IPv6 validation"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.5 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-qcgg-j2x8-h9g8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-56374"
}
]
},
{
"cve": "CVE-2025-13372",
"notes": [
{
"category": "description",
"text": "Django is vulnerable to SQL injection in column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-rqw2-ghq9-44m7",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-13372"
}
]
},
{
"cve": "CVE-2025-26699",
"notes": [
{
"category": "description",
"text": "Django vulnerable to Allocation of Resources Without Limits or Throttling"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.7 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-p3fp-8748-vqfq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-26699"
}
]
},
{
"cve": "CVE-2025-27556",
"notes": [
{
"category": "description",
"text": "Django Potential Denial of Service (DoS) on Windows"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.8 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-wqfg-m96j-85vm",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-27556"
}
]
},
{
"cve": "CVE-2025-32873",
"notes": [
{
"category": "description",
"text": "Django has a denial-of-service possibility in strip_tags()"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.9 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-8j24-cjrq-gr2m",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-32873"
}
]
},
{
"cve": "CVE-2025-48432",
"notes": [
{
"category": "description",
"text": "Django Improper Output Neutralization for Logs vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.10 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-7xr5-9hcq-chf9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-48432"
}
]
},
{
"cve": "CVE-2025-57833",
"notes": [
{
"category": "description",
"text": "Django is subject to SQL injection through its column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.12 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-6w2r-r2m5-xq5w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-57833"
}
]
},
{
"cve": "CVE-2025-59681",
"notes": [
{
"category": "description",
"text": "Django vulnerable to SQL injection in column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.13 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-hpr9-3m2g-3j9p",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-59681"
}
]
},
{
"cve": "CVE-2025-59682",
"notes": [
{
"category": "description",
"text": "Django vulnerable to partial directory traversal via archives"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.13 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-q95w-c7qg-hrff",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-59682"
}
]
},
{
"cve": "CVE-2025-64458",
"notes": [
{
"category": "description",
"text": "Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-qw25-v68c-qjf3",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64458"
}
]
},
{
"cve": "CVE-2025-64459",
"notes": [
{
"category": "description",
"text": "Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-frmv-pr5f-9mcr",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64459"
}
]
},
{
"cve": "CVE-2025-64460",
"notes": [
{
"category": "description",
"text": "Django is vulnerable to DoS via XML serializer text extraction"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.1.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-vrcr-9hj9-jcg6",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64460"
}
]
},
{
"cve": "CVE-2026-15307",
"notes": [
{
"category": "description",
"text": "Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-wvqv-fj8w-qmhm",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-15307"
}
]
},
{
"cve": "CVE-2026-15830",
"notes": [
{
"category": "description",
"text": "Django GeoDjango vulnerable to denial of service through deeply nested geometry collections"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-q238-5cxm-5c9h",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-15830"
}
]
},
{
"cve": "CVE-2026-48587",
"notes": [
{
"category": "description",
"text": "Django: has_vary_header may expose cached responses when Vary values contain whitespace"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-923m-gv2p-w5qp",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-48587"
}
]
},
{
"cve": "CVE-2026-48588",
"notes": [
{
"category": "description",
"text": "Django: cache middleware may expose private responses when unrelated request cookies are present"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-3h9f-r86x-qvjx",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-48588"
}
]
},
{
"cve": "CVE-2026-53877",
"notes": [
{
"category": "description",
"text": "Django: GDALRaster may over-read heap memory when constructed from bytes"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-crhf-3pfg-w68w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-53877"
}
]
},
{
"cve": "CVE-2026-53878",
"notes": [
{
"category": "description",
"text": "Django: DomainNameValidator permits newline characters that may enable HTTP header injection"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-8qcx-xf44-272x",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-53878"
}
]
},
{
"cve": "CVE-2026-54284",
"notes": [
{
"category": "description",
"text": "sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-pwgv-4x5q-6m9f",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54284"
}
]
},
{
"cve": "CVE-2026-59893",
"notes": [
{
"category": "description",
"text": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-prg7-hcfm-mfcr",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-59893"
}
]
},
{
"cve": "CVE-2026-59894",
"notes": [
{
"category": "description",
"text": "sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-3496-9g83-7v6x",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-59894"
}
]
},
{
"cve": "CVE-2026-6873",
"notes": [
{
"category": "description",
"text": "Django: signed cookies are vulnerable to salt namespace collisions"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-h7pc-vwp9-298g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-6873"
}
]
},
{
"cve": "CVE-2026-71491",
"notes": [
{
"category": "description",
"text": "sqlparse: Quadratic O(n²) DoS in group_comments"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-f2ff-p2ww-7p4p",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-71491"
}
]
},
{
"cve": "CVE-2026-8404",
"notes": [
{
"category": "description",
"text": "Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
],
"title": "GHSA-8cjm-8mp7-r2xf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-8404"
}
]
},
{
"cve": "CVE-2026-84305",
"notes": [
{
"category": "description",
"text": "sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-cfqr-cjx5-5jcm",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-84305"
}
]
},
{
"notes": [
{
"category": "description",
"text": "sqlparse: formatting list of tuples leads to denial of service"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.5.4 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0004"
]
}
],
"title": "GHSA-27jp-wm6q-gp25"
},
{
"notes": [
{
"category": "description",
"text": "GHSA-frmv-pr5f-9mcr (CRITICAL) affects pkg:pypi/django@5.1.2. Review the advisory and update or pin a patched version."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004"
]
},
"title": "bomdrift.cve"
}
]
}