Записи djangoproject
162 опубликованных записей вендора djangoproject.
Профиль для исследователя
- Попали в KEV
- 0 · 0 %
- С эксплойтом
- 0 · 0 %
- Pre-auth RCE
- 3
- С записью об исправлении
- 100 %
- Медиана: публикация → KEV
- Ни одна запись не попала в KEV
Повторяющиеся классы
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')16
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')15
- CWE-20 Improper Input Validation13
- CWE-770 Allocation of Resources Without Limits or Throttling10
- CWE-399 Resource Management Errors9
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8
Классы уязвимостей, которые чаще всего встречаются у этого вендора: куда смотреть.
CWEВсе записи
162 записей| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
61На этой неделе | CVE-2022-34265Proof of concept | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.djangoproject · django · CWE-89 | Критическая9,8 | — | 73,6 % | 4 июл. 2022 г. |
59В плане | CVE-2020-7471Proof of concept | Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter djangoproject · django · CWE-89 | Критическая9,8 | — | 65,5 % | 3 февр. 2020 г. |
55В плане | CVE-2019-19844Proof of concept | Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.djangoproject · django · CWE-640 | Критическая9,8 | — | 53,5 % | 18 дек. 2019 г. |
53В плане | CVE-2019-14234Proof of concept | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.djangoproject · django · CWE-89 | Критическая9,8 | — | 47,6 % | 9 авг. 2019 г. |
52В плане | CVE-2021-35042Proof of concept | Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a wdjangoproject · django · CWE-89 | Критическая9,8 | — | 44,3 % | 2 июл. 2021 г. |
49В плане | CVE-2023-24580Эксплойта нет | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.djangoproject · django · CWE-400 | Высокая7,5 | — | 62,5 % | 14 февр. 2023 г. |
46В плане | CVE-2023-46695Эксплойта нет | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.djangoproject · django · CWE-770 | Высокая7,5 | — | 53,4 % | 2 нояб. 2023 г. |
45В плане | CVE-2022-23833Эксплойта нет | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.djangoproject · django · CWE-835 | Высокая7,5 | — | 49,5 % | 2 февр. 2022 г. |
45В плане | CVE-2022-28346Proof of concept | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.djangoproject · django · CWE-89 | Критическая9,8 | — | 18,6 % | 12 апр. 2022 г. |
44В плане | CVE-2023-23969Эксплойта нет | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avodjangoproject · django · CWE-770 | Высокая7,5 | — | 47,3 % | 1 февр. 2023 г. |
42В плане | CVE-2020-9402Proof of concept | Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter djangoproject · django · CWE-89 | Высокая8,8 | — | 23,9 % | 5 мар. 2020 г. |
42В плане | CVE-2025-64459Proof of concept | Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject · django · CWE-89 | Критическая9,1 | — | 19,2 % | 5 нояб. 2025 г. |
41В плане | CVE-2016-9013Эксплойта нет | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whedjangoproject · django · CWE-798 | Критическая9,8 | — | 5,1 % | 9 дек. 2016 г. |
41В плане | CVE-2014-0474Эксплойта нет | The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.canonical · ubuntu linux · CWE-399 | Критическая10,0 | — | 4,8 % | 23 апр. 2014 г. |
40В плане | CVE-2025-57833Proof of concept | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.djangoproject · django · CWE-89 | Высокая8,1 | — | 28,2 % | 3 сент. 2025 г. |
40В плане | CVE-2022-28347Эксплойта нет | A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.djangoproject · django · CWE-89 | Критическая9,8 | — | 2,9 % | 12 апр. 2022 г. |
39Наблюдать | CVE-2024-39614Proof of concept | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.djangoproject · django · CWE-130 | Высокая7,5 | — | 28,6 % | 10 июл. 2024 г. |
39Наблюдать | CVE-2024-53908Эксплойта нет | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.djangoproject · django · CWE-89 | Критическая9,8 | — | 1,4 % | 6 дек. 2024 г. |
39Наблюдать | CVE-2023-31047Эксплойта нет | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploadjangoproject · django · CWE-20 | Критическая9,8 | — | 1,3 % | 6 мая 2023 г. |
39Наблюдать | CVE-2025-59681Эксплойта нет | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject · django · CWE-89 | Критическая9,8 | — | 0,6 % | 1 окт. 2025 г. |
39Наблюдать | CVE-2026-4277Эксплойта нет | Privilege abuse in GenericInlineModelAdmindjangoproject · django · CWE-862 | Критическая9,8 | — | 0,4 % | 7 апр. 2026 г. |
38Наблюдать | CVE-2024-45230Эксплойта нет | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.djangoproject · django · CWE-120 | Высокая7,5 | — | 25,7 % | 8 окт. 2024 г. |
35Наблюдать | CVE-2021-23336Эксплойта нет | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 python · python · CWE-444 | Средняя5,9 | — | 40,7 % | 15 февр. 2021 г. |
35Наблюдать | CVE-2022-36359Эксплойта нет | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.djangoproject · django · CWE-494 | Высокая8,8 | — | 0,9 % | 3 авг. 2022 г. |
34Наблюдать | CVE-2016-9014Эксплойта нет | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to confedoraproject · fedora · CWE-264 | Высокая8,1 | — | 6,0 % | 9 дек. 2016 г. |
- CVE-2022-3426561На этой неделе
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
КритическаяCVSS 9,8Proof of conceptEPSS 73 %djangoproject · django4 июл. 2022 г.
- CVE-2020-747159В плане
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter
КритическаяCVSS 9,8Proof of conceptEPSS 65 %djangoproject · django3 февр. 2020 г.
- CVE-2019-1984455В плане
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
КритическаяCVSS 9,8Proof of conceptEPSS 53 %djangoproject · django18 дек. 2019 г.
- CVE-2019-1423453В плане
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
КритическаяCVSS 9,8Proof of conceptEPSS 47 %djangoproject · django9 авг. 2019 г.
- CVE-2021-3504252В плане
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w
КритическаяCVSS 9,8Proof of conceptEPSS 44 %djangoproject · django2 июл. 2021 г.
- CVE-2023-2458049В плане
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.
ВысокаяCVSS 7,5Эксплойта нетEPSS 62 %djangoproject · django14 февр. 2023 г.
- CVE-2023-4669546В плане
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.
ВысокаяCVSS 7,5Эксплойта нетEPSS 53 %djangoproject · django2 нояб. 2023 г.
- CVE-2022-2383345В плане
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.
ВысокаяCVSS 7,5Эксплойта нетEPSS 49 %djangoproject · django2 февр. 2022 г.
- CVE-2022-2834645В плане
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
КритическаяCVSS 9,8Proof of conceptEPSS 18 %djangoproject · django12 апр. 2022 г.
- CVE-2023-2396944В плане
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo
ВысокаяCVSS 7,5Эксплойта нетEPSS 47 %djangoproject · django1 февр. 2023 г.
- CVE-2020-940242В плане
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter
ВысокаяCVSS 8,8Proof of conceptEPSS 23 %djangoproject · django5 мар. 2020 г.
- CVE-2025-6445942В плане
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
КритическаяCVSS 9,1Proof of conceptEPSS 19 %djangoproject · django5 нояб. 2025 г.
- CVE-2016-901341В плане
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whe
КритическаяCVSS 9,8Эксплойта нетEPSS 5 %djangoproject · django9 дек. 2016 г.
- CVE-2014-047441В плане
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.
КритическаяCVSS 10,0Эксплойта нетEPSS 4 %canonical · ubuntu linux23 апр. 2014 г.
- CVE-2025-5783340В плане
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.
ВысокаяCVSS 8,1Proof of conceptEPSS 28 %djangoproject · django3 сент. 2025 г.
- CVE-2022-2834740В плане
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
КритическаяCVSS 9,8Эксплойта нетEPSS 2 %djangoproject · django12 апр. 2022 г.
- CVE-2024-3961439Наблюдать
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.
ВысокаяCVSS 7,5Proof of conceptEPSS 28 %djangoproject · django10 июл. 2024 г.
- CVE-2024-5390839Наблюдать
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %djangoproject · django6 дек. 2024 г.
- CVE-2023-3104739Наблюдать
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploa
КритическаяCVSS 9,8Эксплойта нетEPSS 1 %djangoproject · django6 мая 2023 г.
- CVE-2025-5968139Наблюдать
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %djangoproject · django1 окт. 2025 г.
- CVE-2026-427739Наблюдать
Privilege abuse in GenericInlineModelAdmin
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %djangoproject · django7 апр. 2026 г.
- CVE-2024-4523038Наблюдать
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.
ВысокаяCVSS 7,5Эксплойта нетEPSS 25 %djangoproject · django8 окт. 2024 г.
- CVE-2021-2333635Наблюдать
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2
СредняяCVSS 5,9Эксплойта нетEPSS 40 %python · python15 февр. 2021 г.
- CVE-2022-3635935Наблюдать
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %djangoproject · django3 авг. 2022 г.
- CVE-2016-901434Наблюдать
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to con
ВысокаяCVSS 8,1Эксплойта нетEPSS 6 %fedoraproject · fedora9 дек. 2016 г.