p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de django · Page n° 2

Vulnérabilité publiée pour django au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 162

  1. CVE-2025-14550

    Élevée · CVSS 7.5EPSS 1,13%Correctif disponible

    Potential denial-of-service vulnerability via repeated headers when using ASGI

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-1312

    Moyenne · CVSS 5.4EPSS 0,91%Correctif disponible

    Potential SQL injection via QuerySet.order_by and FilteredRelation

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-1287

    Moyenne · CVSS 5.4EPSS 0,86%Correctif disponible

    Potential SQL injection in column aliases via control characters

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-1285

    Élevée · CVSS 7.5EPSS 1,13%Correctif disponible

    Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-1207

    Moyenne · CVSS 5.4EPSS 12,82%Code d’exploitation publicCorrectif disponible

    Potential SQL injection via raster lookups on PostGIS

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2025-13473

    Moyenne · CVSS 5.3EPSS 0,81%Correctif disponible

    Username enumeration through timing difference in mod_wsgi authentication handler

    An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.28
    • Mettez à jour vers 5.2.11
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2025-64460

    Élevée · CVSS 7.5EPSS 2,08%Correctif disponible

    Potential denial-of-service vulnerability in XML serializer text extraction

    An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.27
    • Mettez à jour vers 5.1.15
    • Mettez à jour vers 5.2.9
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2025-13372

    Moyenne · CVSS 4.3EPSS 0,92%Correctif disponible

    Potential SQL injection in FilteredRelation column aliases on PostgreSQL

    An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.27
    • Mettez à jour vers 5.1.15
    • Mettez à jour vers 5.2.9
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2025-64459

    Critique · CVSS 9.1EPSS 19,26%Code d’exploitation publicCorrectif disponible

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.26
    • Mettez à jour vers 5.1.14
    • Mettez à jour vers 5.2.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2025-64458

    Élevée · CVSS 7.5EPSS 1,91%Correctif disponible

    Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

    django django django djangoPython
    • Mettez à jour vers 4.2.26
    • Mettez à jour vers 5.1.14
    • Mettez à jour vers 5.2.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2025-59682

    Faible · CVSS 3.1EPSS 0,93%Correctif disponible

    CVE-2025-59682

    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

    django django django djangoPython
    • Mettez à jour vers 4.2.25
    • Mettez à jour vers 5.1.13
    • Mettez à jour vers 5.2.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2025-59681

    Élevée · CVSS 7.1EPSS 0,64%Correctif disponible

    CVE-2025-59681

    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

    django django django djangoPython
    • Mettez à jour vers 4.2.25
    • Mettez à jour vers 5.1.13
    • Mettez à jour vers 5.2.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2025-57833

    Élevée · CVSS 7.1EPSS 26,11%Correctif disponible

    CVE-2025-57833

    An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

    django django django djangoPython
    • Mettez à jour vers 4.2.24
    • Mettez à jour vers 5.1.12
    • Mettez à jour vers 5.2.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2025-48432

    Moyenne · CVSS 4EPSS 0,75%Correctif disponible

    CVE-2025-48432

    An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

    django django django djangoPython
    • Mettez à jour vers 4.2.22
    • Mettez à jour vers 5.1.10
    • Mettez à jour vers 5.2.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2025-32873

    Moyenne · CVSS 5.3EPSS 14,31%Correctif disponible

    CVE-2025-32873

    An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

    django django django djangoPython
    • Mettez à jour vers 4.2.21
    • Mettez à jour vers 5.1.9
    • Mettez à jour vers 5.2.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2025-27556

    Moyenne · CVSS 5.8EPSS 1,08%Correctif disponible

    CVE-2025-27556

    An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

    django django djangoPython
    • Mettez à jour vers 5.0.14
    • Mettez à jour vers 5.1.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2025-26699

    Moyenne · CVSS 5EPSS 0,83%Correctif disponible

    CVE-2025-26699

    An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

    django django django djangoPython
    • Mettez à jour vers 4.2.20
    • Mettez à jour vers 5.0.13
    • Mettez à jour vers 5.1.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2024-56374

    Moyenne · CVSS 5.8EPSS 1,28%Correctif disponible

    CVE-2024-56374

    An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

    django django django djangoPython
    • Mettez à jour vers 4.2.18
    • Mettez à jour vers 5.0.11
    • Mettez à jour vers 5.1.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2024-53908

    Critique · CVSS 9.8EPSS 1,42%Correctif disponible

    CVE-2024-53908

    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

    django django django django django django djangoPython
    • Mettez à jour vers 4.2.17
    • Mettez à jour vers 5.0.10
    • Mettez à jour vers 5.1.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2024-53907

    Élevée · CVSS 7.5EPSS 1,39%Correctif disponible

    CVE-2024-53907

    An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

    django django django django django django djangoPython
    • Mettez à jour vers 4.2.17
    • Mettez à jour vers 5.0.10
    • Mettez à jour vers 5.1.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →