CVE-2026-44987 SysReptor: Privilege Escalation from User Admin to Superuser

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled non-default, they can res...

CVE-2026-44987 SysReptor: Privilege Escalation from User Admin to Superuser

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled non-default, they can res...

Missing Authorization

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Missing Authorization in the admin changelist forms using ModelAdmin.listeditable. An attacker can gain unauthorized access to...

CVE-2026-4292

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

CVE-2026-4292

The Django web development framework is vulnerable to a privilege abuse issue in its admin changelist forms . Specifically, forms utilizing ModelAdmin.list_editable incorrectly permitted the creation of new instances through forged POST data . This vulnerability affects Django versions 6.0 before...

Linux Distros Unpatched Vulnerability : CVE-2026-4292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed...

django-admin-caching (0.1.3), django-budget (0.7.2) +19 more potentially affected by CVE-2025-64458 via django (1.11.0)

django PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching 0.1.3 - django-budget 0.7.2 - django-currentuser =0.1.0, =0.1.2, =1.5.0, =1.1.7, =0.0.1, =1.18.0, =1.20.0 and more Source cves...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2025-64458 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2025-48432 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

cfl-common (8.6.0), cg-django-uaa (2.1.9) +10 more potentially affected by CVE-2025-32873 via django (5.2.0)

django PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cfl-common 8.6.0 - cg-django-uaa 2.1.9 - django-admin-flexlist =0.1.0, =1.92.0.5, =0.1.0, =1.0.0, =0.199.0, =1.2.4, =1.2.7 Source cves: CVE-2025-328...

alcali (>=2018.3.4, <=2019.2.4.post0), django-acsecure (0.1.3) +12 more potentially affected by CVE-2024-45231 via django (3.0.3)

django PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.4, =0.2.0, =0.1.5.1, =0.0.2, =0.1.1, =0.9.0, =0.1.0.1, =0.4.1, =0.5.1 Source cves: CVE-2024-45231 Source advisory:...

SUSE CVE-2013-0305

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information...

SUSE CVE-2014-0483

The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...

SUSE CVE-2016-6186

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

admin-extra-urls (0.7.0), barbeque (0.2.1) +30 more potentially affected by CVE-2022-36359 +1 more via django (1.7.11)

django PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admin-extra-urls 0.7.0 - barbeque 0.2.1 - django-active-users 0.0.1.4 - django-admin-enhancer 1.0.0 - django-babel =0.3.6, =0.1.0, =3.0.13, =1.0.0,...

django: Potential directory traversal via ``admindocs``

A flaw was found in django. Staff members could use the :mod:django.contrib.admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been customized by the developers to also expose the file contents, then not...

CVE-2018-16984

CVE-2018-16984 affects Django 2.1 before 2.1.2, where unprivileged admin users with view permissions can see full password hashes in the change form. The issue is due to bypassing the read-only password widget used to obfuscate hashes. Public records across multiple feeds (including Debian/ALT Li...

CVE-2018-16984: Insufficiently Protected Credentials

An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission new in Django 2.1...

Cross site scripting vulnerability in django-epiceditor（CVE-2017-6591）

Introduction django-epiceditor A django app that allows the easy addition of EpicEditor markdown editor to a django form field, whether in a custom app or the Django Admin. The project url: https://pypi.python.org/pypi/django-epiceditor Environment django==1.10.6 django-epiceditor==0.2.3...

DEBIAN-CVE-2016-6186

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...