7 matches found
CVE-2026-113733
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...
CVE-2026-113733
An issue exists in Django 6.1 before 6.1.3 and 6.0 before 6.0.10 involving the django.contrib.admin.utils.display_for_field() function. The function fails to obfuscate the password field for user models other than AUTH_USER_MODEL, or for models inheriting a password field through multi-table inhe...
EUVD-2026-116022
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...
CVE-2026-113733: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...
ALPINE-CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. "django.contrib.admin.utils.displayforfield" renders "URLField" values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admi...
CVE-2026-15920: Improper Neutralization of Script in Attributes in a Web Page
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...