CVE-2025-24370

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality "setpropertyvalue", which can be remotely triggered by users by craftin...

CVE-2025-24370

CVE-2025-24370 affects django-unicorn. The issue stems from the vulnerable set_property_value function, which can be remotely triggered via component requests (syncInput payload) to modify Python runtime state, enabling XSS, DoS, and authentication bypass across Django-Unicorn-based apps. Remedia...

CVE-2025-24370 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

CVE-2025-24370 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

CVE-2025-24370 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

tvsd (>=1.4.0, <=1.4.1) potentially affected by CVE-2025-24370 via django-unicorn (0.59.0)

django-unicorn PYPI version 0.59.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-unicorn and may be impacted: - tvsd =1.4.0, =1.4.1 Source cves: CVE-2025-24370 Source advisory: OSV:GHSA-G9WF-5777-GQ43...

tvsd (>=1.4.0, <=1.4.1) potentially affected by CVE-2025-24370 via django-unicorn (0.59.0)

django-unicorn PYPI version 0.59.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-unicorn and may be impacted: - tvsd =1.4.0, =1.4.1 Source cves: CVE-2025-24370 Source advisory: GHSA-G9WF-5777-GQ43...

Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Summary Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting appropriate component requests and feedi...

GHSA-G9WF-5777-GQ43 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Summary Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting appropriate component requests and feedi...

Django security vulnerabilities

Django is a set of open source web application frameworks based on the Python language from the Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django-Unicorn versions prior to 0.61.0, which stems from...

PT-2025-5349

Name of the Vulnerable Software and Affected Versions Django-Unicorn versions prior to 0.62.0 Description The vulnerability arises from the core functionality set property value, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of the secon...

CVE-2025-24370: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

Cross-site Scripting (XSS)

Overview django-froala-editor is a django-froala-editor package helps integrate Froala WYSIWYG HTML editor with Django. Affected versions of this package are vulnerable to Cross-site Scripting XSS when pasting copied content into the editor. Details Cross-site scripting or XSS is a code...

Server-side Request Forgery (SSRF)

Overview django-icon-picker is an A custom Django model field that allows users to select icons from a predefined set. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the downloadandsavesvg function, which interpolates arbitrary URLs without filtering out...

Autodesk: Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.com

The domain api.wwm-dev.autodesk.com was discovered to have Django debug mode enabled, which led to information disclosure. The issue was fixed by Autodesk...

django: Potential denial-of-service in django.utils.html.strip_tags()

A vulnerability was found in the Django Web Framework. The striptags and stripbtags template filter may be vulnerable to a potential denial of service DoS in cases of a large sequence of nested incomplete HTML entities...

django: potential denial-of-service vulnerability in IPv6 validation

A flaw was found in the Django framework. Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial of service attack. The undocumented and private functions cleanipv6address and isvalidipv6address were vulnerable, as was the...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:0777)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0777 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

django: Potential SQL injection in HasKey(lhs, rhs) on Oracle

A vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries...

ROS-20250127-01

Vulnerability of striptags function of django.utils.html module of Django web application software platform is related to unrestricted resource allocation as a result of incorrect HTML character escaping. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial ...