-CVE-2024-39614

Proof of Concept PoC per la vulnerabilità Denial-of-Service in Django Questo repository contiene uno script Proof of Concept PoC che dimostra una vulnerabilità denial-of-service DoS in Django versioni 5.0 precedenti alla 5.0.7 e 4.2 precedenti alla 4.2.14. La vulnerabilità risiede nella funzione...

Django-faille-CVE-2025-57833_test

Test der SQL-Injection-Schwachstelle über Alias in Django Definition: Was ist ein Alias? Ein Alias ist ein Name, der einer Spalte oder einem Aggregationsergebnis in einer SQL-Abfrage gegeben wird. In Django werden Aliase mit den Methoden annotate oder alias verwendet, um berechnete Felder zu...

CVE-2025-64459-hunter

CVE-2025-64459-hunter Schneller Netzwerkscanner für CVE-2025-64459 Django SQL-Injection-Schwachstelle. Installation root@kitploit: pip install -r requirements.txt Verwendung root@kitploit: Scan single IP python cve202564459hunter.py -t 192.168.1.100 Scan CIDR range python cve202564459hunter.py -t...

INT14107_CVE-2021-35042

Progetto Blog CTF Questo progetto è un sistema di Blog dedicato al CTF Capture The Flag costruito con Django. Funzionalità Pubblicazione di articoli, commenti. Gestione di Utenti e Categorie. Integrazione di strumenti di test di sicurezza exploitdump.py. Istruzioni di installazione 1. Installare...

CVE-2021-35042

CVE-2021-35042: Django SQL-Injection-Sicherheitslücke I. Überblick Django ist ein Open-Source-Webanwendungs-Framework, das in Python geschrieben und nach dem MVC-Modell Model-View-Controller aufgebaut ist. Ursprünglich wurde es zur Verwaltung von Nachrichten-Webseiten entwickelt, die dem...

static-file-checker

static-file-checker Verifica se há credenciais expostas no /static/staticfiles.json do Django usando nuclei...

exist

EXIST Sistema di aggregazione di informazioni esterne contro le minacce informatiche ⚠️ Questo repository non è più mantenuto / archiviato. I problemi di sicurezza non verranno risolti. EXIST è un'applicazione web per aggregare e analizzare CTI intelligence sulle minacce informatiche. EXIST è...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

pulsar

Pulsar Cos'è? Pulsar è uno scanner automatico di footprint di rete per Red Team, Penetration Tester e Cacciatori di Bug. È focalizzato sulla scoperta di asset pubblici di un'organizzazione con una conoscenza minima della sua infrastruttura. Oltre alla visualizzazione dei dati di rete, tenta di...

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

EUVD-2026-65600

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...