djangoproject kayıtları
djangoproject üreticisine ait 162 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 3
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')16
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')15
- CWE-20 Improper Input Validation13
- CWE-770 Allocation of Resources Without Limits or Throttling10
- CWE-399 Resource Management Errors9
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
162 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
61Bu hafta | CVE-2022-34265Kavram kanıtı | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.djangoproject · django · CWE-89 | Kritik9,8 | — | %73,6 | 4 Tem 2022 |
59Planlayın | CVE-2020-7471Kavram kanıtı | Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter djangoproject · django · CWE-89 | Kritik9,8 | — | %65,5 | 3 Şub 2020 |
55Planlayın | CVE-2019-19844Kavram kanıtı | Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.djangoproject · django · CWE-640 | Kritik9,8 | — | %53,5 | 18 Ara 2019 |
53Planlayın | CVE-2019-14234Kavram kanıtı | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.djangoproject · django · CWE-89 | Kritik9,8 | — | %47,6 | 9 Ağu 2019 |
52Planlayın | CVE-2021-35042Kavram kanıtı | Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a wdjangoproject · django · CWE-89 | Kritik9,8 | — | %44,3 | 2 Tem 2021 |
49Planlayın | CVE-2023-24580İstismar yok | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.djangoproject · django · CWE-400 | Yüksek7,5 | — | %62,5 | 14 Şub 2023 |
46Planlayın | CVE-2023-46695İstismar yok | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.djangoproject · django · CWE-770 | Yüksek7,5 | — | %53,4 | 2 Kas 2023 |
45Planlayın | CVE-2022-23833İstismar yok | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.djangoproject · django · CWE-835 | Yüksek7,5 | — | %49,5 | 2 Şub 2022 |
45Planlayın | CVE-2022-28346Kavram kanıtı | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.djangoproject · django · CWE-89 | Kritik9,8 | — | %18,6 | 12 Nis 2022 |
44Planlayın | CVE-2023-23969İstismar yok | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avodjangoproject · django · CWE-770 | Yüksek7,5 | — | %47,3 | 1 Şub 2023 |
42Planlayın | CVE-2020-9402Kavram kanıtı | Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter djangoproject · django · CWE-89 | Yüksek8,8 | — | %22,5 | 5 Mar 2020 |
42Planlayın | CVE-2025-64459Kavram kanıtı | Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject · django · CWE-89 | Kritik9,1 | — | %19,2 | 5 Kas 2025 |
41Planlayın | CVE-2016-9013İstismar yok | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whedjangoproject · django · CWE-798 | Kritik9,8 | — | %5,1 | 9 Ara 2016 |
41Planlayın | CVE-2014-0474İstismar yok | The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.canonical · ubuntu linux · CWE-399 | Kritik10,0 | — | %4,8 | 23 Nis 2014 |
40Planlayın | CVE-2025-57833Kavram kanıtı | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.djangoproject · django · CWE-89 | Yüksek8,1 | — | %28,2 | 3 Eyl 2025 |
40Planlayın | CVE-2022-28347İstismar yok | A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.djangoproject · django · CWE-89 | Kritik9,8 | — | %2,9 | 12 Nis 2022 |
39İzleyin | CVE-2024-39614Kavram kanıtı | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.djangoproject · django · CWE-130 | Yüksek7,5 | — | %28,6 | 10 Tem 2024 |
39İzleyin | CVE-2024-53908İstismar yok | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.djangoproject · django · CWE-89 | Kritik9,8 | — | %1,4 | 6 Ara 2024 |
39İzleyin | CVE-2023-31047İstismar yok | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploadjangoproject · django · CWE-20 | Kritik9,8 | — | %1,3 | 6 May 2023 |
39İzleyin | CVE-2025-59681İstismar yok | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.djangoproject · django · CWE-89 | Kritik9,8 | — | %0,6 | 1 Eki 2025 |
39İzleyin | CVE-2026-4277İstismar yok | Privilege abuse in GenericInlineModelAdmindjangoproject · django · CWE-862 | Kritik9,8 | — | %0,4 | 7 Nis 2026 |
38İzleyin | CVE-2024-45230İstismar yok | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.djangoproject · django · CWE-120 | Yüksek7,5 | — | %25,7 | 8 Eki 2024 |
35İzleyin | CVE-2021-23336İstismar yok | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 python · python · CWE-444 | Orta5,9 | — | %40,7 | 15 Şub 2021 |
35İzleyin | CVE-2022-36359İstismar yok | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.djangoproject · django · CWE-494 | Yüksek8,8 | — | %0,9 | 3 Ağu 2022 |
34İzleyin | CVE-2016-9014İstismar yok | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to confedoraproject · fedora · CWE-264 | Yüksek8,1 | — | %6,0 | 9 Ara 2016 |
- CVE-2022-3426561Bu hafta
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
KritikCVSS 9,8Kavram kanıtıEPSS %73djangoproject · django4 Tem 2022
- CVE-2020-747159Planlayın
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter
KritikCVSS 9,8Kavram kanıtıEPSS %65djangoproject · django3 Şub 2020
- CVE-2019-1984455Planlayın
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.
KritikCVSS 9,8Kavram kanıtıEPSS %53djangoproject · django18 Ara 2019
- CVE-2019-1423453Planlayın
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.
KritikCVSS 9,8Kavram kanıtıEPSS %47djangoproject · django9 Ağu 2019
- CVE-2021-3504252Planlayın
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w
KritikCVSS 9,8Kavram kanıtıEPSS %44djangoproject · django2 Tem 2021
- CVE-2023-2458049Planlayın
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.
YüksekCVSS 7,5İstismar yokEPSS %62djangoproject · django14 Şub 2023
- CVE-2023-4669546Planlayın
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.
YüksekCVSS 7,5İstismar yokEPSS %53djangoproject · django2 Kas 2023
- CVE-2022-2383345Planlayın
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.
YüksekCVSS 7,5İstismar yokEPSS %49djangoproject · django2 Şub 2022
- CVE-2022-2834645Planlayın
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
KritikCVSS 9,8Kavram kanıtıEPSS %18djangoproject · django12 Nis 2022
- CVE-2023-2396944Planlayın
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo
YüksekCVSS 7,5İstismar yokEPSS %47djangoproject · django1 Şub 2023
- CVE-2020-940242Planlayın
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter
YüksekCVSS 8,8Kavram kanıtıEPSS %22djangoproject · django5 Mar 2020
- CVE-2025-6445942Planlayın
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
KritikCVSS 9,1Kavram kanıtıEPSS %19djangoproject · django5 Kas 2025
- CVE-2016-901341Planlayın
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whe
KritikCVSS 9,8İstismar yokEPSS %5djangoproject · django9 Ara 2016
- CVE-2014-047441Planlayın
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.
KritikCVSS 10,0İstismar yokEPSS %4canonical · ubuntu linux23 Nis 2014
- CVE-2025-5783340Planlayın
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.
YüksekCVSS 8,1Kavram kanıtıEPSS %28djangoproject · django3 Eyl 2025
- CVE-2022-2834740Planlayın
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
KritikCVSS 9,8İstismar yokEPSS %2djangoproject · django12 Nis 2022
- CVE-2024-3961439İzleyin
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.
YüksekCVSS 7,5Kavram kanıtıEPSS %28djangoproject · django10 Tem 2024
- CVE-2024-5390839İzleyin
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.
KritikCVSS 9,8İstismar yokEPSS %1djangoproject · django6 Ara 2024
- CVE-2023-3104739İzleyin
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploa
KritikCVSS 9,8İstismar yokEPSS %1djangoproject · django6 May 2023
- CVE-2025-5968139İzleyin
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
KritikCVSS 9,8İstismar yokEPSS %0djangoproject · django1 Eki 2025
- CVE-2026-427739İzleyin
Privilege abuse in GenericInlineModelAdmin
KritikCVSS 9,8İstismar yokEPSS %0djangoproject · django7 Nis 2026
- CVE-2024-4523038İzleyin
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.
YüksekCVSS 7,5İstismar yokEPSS %25djangoproject · django8 Eki 2024
- CVE-2021-2333635İzleyin
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2
OrtaCVSS 5,9İstismar yokEPSS %40python · python15 Şub 2021
- CVE-2022-3635935İzleyin
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.
YüksekCVSS 8,8İstismar yokEPSS %0djangoproject · django3 Ağu 2022
- CVE-2016-901434İzleyin
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to con
YüksekCVSS 8,1İstismar yokEPSS %6fedoraproject · fedora9 Ara 2016