Cross-site scripting in django

Improper query string handling in Django

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

Django User Enumeration Vulnerability

Django Incorrectly Validates URLs

Django vulnerable to Denial of Service

Django CSRF Protection Bypass

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.

Django ReDoS in validators.URLValidator

Django Cross-site scripting Vulnerability

Django Denial-of-service in django.utils.text.Truncator

Django Admin Media Handler Vulnerable to Directory Traversal

Django vulnerable to Denial of Service via i18n middleware component

Django vulnerable to XSS on 500 pages

Django Path Traversal vulnerability

Django cross-site scripting (XSS) vulnerability via is_safe_url function

Cross-site Scripting in Django

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

Django vulnerable to Reflected File Download attack