Django vulnerable to Denial of Service

Django has a potential denial-of-service vulnerability in IPv6 validation

Django Arbitrary Code Execution

Django vulnerable to partial directory traversal via archives

Django Vulnerable to Cache Poisoning

Django Vulnerable to HTTP Response Splitting Attack

Django contains Uncontrolled Resource Consumption via cached header

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.

Django vulnerable to privilege abuse in GenericInlineModelAdmin

Django XSS Vulnerability

Django SQL injection vulnerability

** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module.

Django denial of service via empty session record creation

Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks

Django Regex Algorithmic Complexity Causes Denial of Service

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

Django vulnerable to Allocation of Resources Without Limits or Throttling

Django Improper Access Control

Django has an SQL Injection issue

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation