Django has a potential denial-of-service vulnerability in IPv6 validation

Django Arbitrary Code Execution

Django vulnerable to partial directory traversal via archives

Django Vulnerable to Cache Poisoning

Django Vulnerable to HTTP Response Splitting Attack

Django contains Uncontrolled Resource Consumption via cached header

Django vulnerable to privilege abuse in GenericInlineModelAdmin

Django XSS Vulnerability

Django SQL injection vulnerability

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.

Django denial of service via empty session record creation

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

Django Regex Algorithmic Complexity Causes Denial of Service

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

Django vulnerable to Allocation of Resources Without Limits or Throttling

Django Improper Access Control

Django has an SQL Injection issue

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

Django user with hardcoded password created when running tests on Oracle

Django vulnerable to privilege abuse in ModelAdmin.list_editable