Django Debug Page - Cross-Site Scripting

Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5 has HTML autoescaping disabled in a portion of the template for the technical 500 debug page. We detected that right circumstances DEBUG=True are present to allow a cross-site scripting attack. id: CVE-2017-12794 info: name: Django Debug Page -...

djangodjangodjango (4.0.0b1) potentially affected by CVE-2026-8404 via django (4.0.0b1)

django PYPI version 4.0.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - djangodjangodjango 4.0.0b1 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

Django SQL Injection

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break characte...