CVE-2022-34265

CVE-2022-34265 Vulnerability Summary This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookupname argument of...

CVE-2019-14234

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit CVE-2019-14234 Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField. Reference link:...

django-security-advisory-3.2.16

django-security-advisory-3.2.16 Security advisory tracking for Django 3.2.16 vulnerabilities - CVE-2023-23969 and CVE-2023-24580...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built according to the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

exist

EXIST Sistema de Agregación de Información Externa contra Amenazas Cibernéticas ⚠️ Este repositorio no tiene mantenimiento / está archivado. Los problemas de seguridad no se corregirán. EXIST es una aplicación web para agregar y analizar CTI inteligencia de amenazas cibernéticas. EXIST está escrit...

pulsar

Pulsar What is it? Pulsar is an automated network footprint scanner for Red Teams, Pentesters and Bounty Hunters. Its focused on discovery of organization public facing assets with minimal knowledge about its infrastructure. Along with network data visualization, it attempts to give a basic...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

CVE-2026-1312

CVE-2026-1312 is a high-severity Django SQL injection vulnerability: when a column alias containing a dot is used in QuerySet.orderby, combined with FilteredRelation dynamically constructing queries via dictionary expansion, an attacker may be able to inject malicious SQL Affected versions:...

CVE-2026-1207

CVE-2026-1207 Django GIS RasterField SQL Injection Vulnerability Reproduction Vulnerability Overview Vulnerability Type : SQL Injection Affected Component : django.contrib.gis RasterField When querying with Django GIS's RasterField, the band parameter is directly concatenated into the SQL...

CVE-2025-57833

CVE-2025-57833 Example Vulnerable application for CVE-2025–57833 Django 4.2 before 4.2.24 Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6 is vulnerable to a SQL injection via Dictionary expansion as kwargs is passed to QuerySet.annotate or QuerySet.alias Currently a work in...

django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459-Testbed A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter parameter injection via dictionary expansion using Docker. About the Vulnerability CVE-2025-64459 is a high-severity vulnerability in Django specifically versions 5.1.14 that allows...

CVE-2026-33033-PoC

CVE-2026-33033 PoC Denial-of-service via base64 whitespace CPU amplification in DjangoMultiPartParser A single 2.5 MB HTTP request can tie up a Django worker for 5 seconds , achieving 2,100x CPU amplification over a normal request of the same size. No authentication is required. Affected Versions...

CVE-2026-33149-PoC

CVE-2026-33149 — Host Header Injection in Tandoor Recipes Summary Tandoor Recipes sets ALLOWEDHOSTS = '' by default in settings.py, causing Django to accept any value in the HTTP Host header without validation. The application uses request.buildabsoluteuri to generate absolute URLs in multiple...

django-xss-example

Local Testing Works only on Linux. On Windows, one of the dependencies may cause an error. Before running, you need to install the following packages: pip install -r requirements.txt Make sure the packages are installed python -m django --version pip install django==4.0.1 grammarinator-generate...

DjVul_StringAgg

Django CVE-2020-7471 SQLi CVE-2020-7471: Potential SQL injection via StringAggdelimiter django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. RUN python manage.py makemigrations python manage.py migrate python manage.py...

django_sqli_target_CVE-2025-64459

This repository does not have a README...

django-cve-2025-64459

Django CVE-2025-64459 This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django. SQL Injection SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the...

Python Library Django 5.2.x < 5.2.18 / 6.0.x < 6.0.9 / 6.1.x < 6.1.2 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.18, or 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities, including: - django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attac...