CVE-2019-14234

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit CVE-2019-14234 Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField. Reference link:...

Debian dla-4736 : python-django-doc - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4736 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected]...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-15307 via django (4.0.0rc1)

django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-15307 Source...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

Django 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by a cross-site scripting issue in django.contrib.admin.utils.display_for_field() that renders URLField values as clickable links without validating the URL. If an unsafe URL is already stored (e.g., via direct queryset writes, deserializ...

CVE-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

EUVD-2026-52750

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-48588 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-53878 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

alcali (>=2018.3.4, <=2019.2.4.post0), django-acsecure (0.1.3) +12 more potentially affected by CVE-2026-53878 via django (3.0.3)

django PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.4, =0.2.0, =0.1.5.1, =0.0.2, =0.1.1, =0.9.0, =0.1.0.1, =0.4.1, =0.5.1 Source cves: CVE-2026-53878 Source advisory:...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2024-45231 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-48587 via django (4.0.0rc1)

django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-48587 Source...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-8404 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

CVE-2026-42197

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin...

CVE-2026-42197 RELATE Vulnerable to Stored XSS via Unprivileged User Profile

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin...

CVE-2026-42197: Improper Neutralization of Input During Web Page Generation

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin...

CVE-2026-44987

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled non-default, they can res...

CVE-2026-44987

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled non-default, they can res...

EUVD-2026-28870

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled non-default, they can res...