Django Vulnerable to HTTP Response Splitting Attack

Django contains Uncontrolled Resource Consumption via cached header

Django XSS Vulnerability

Django SQL injection vulnerability

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.

Django denial of service via empty session record creation

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

Django Regex Algorithmic Complexity Causes Denial of Service

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

Django vulnerable to Allocation of Resources Without Limits or Throttling

Django Improper Access Control

Django user with hardcoded password created when running tests on Oracle

Django SQL injection in HasKey(lhs, rhs) on Oracle

Directory-traversal in Django

Django DoS in django.views.static.serve

Django memory consumption vulnerability

Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

Django Denial-of-service possibility with strip_tags

Django allows unintended model editing

Django vulnerable to SQL injection in column aliases