[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvKahHOxYvltjDKEEBMssSbIGjzXf_ekUHSkJmzTa-1c":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":35,"kevVulnerabilities":95,"topProductsByCves":96,"seoMetadata":101,"meta":110},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":34},8141,"djangoproject",4,126,0,440,"2025-10-01","d",[16,21,27,31],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},37130,"django",375,123,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},37129,"channels",63,1,"2021-02-22",{"id":28,"product_name":29,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":30},37131,"piston","2014-10-27",{"id":32,"product_name":33,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":30},37132,"tastypie","Djangoproject is a technology vendor with 4 tracked products and 126 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[36,45,50,57,62,67,72,78,83,88],{"cveId":37,"description":38,"publishedDate":39,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":43,"epssScore":44},"CVE-2022-34265","An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind\u002Flookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.","2022-07-04",9.8,"v3.1","Critical",false,0.73607,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":43,"epssScore":49},"CVE-2020-7471","Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.","2020-02-03",0.65575,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":41,"severity":55,"isKev":43,"epssScore":56},"CVE-2023-24580","An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.","2023-02-15",7.5,"High",0.62575,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":43,"epssScore":61},"CVE-2019-19844","Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)","2019-12-18",0.53561,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":54,"cvssVersion":41,"severity":55,"isKev":43,"epssScore":66},"CVE-2023-46695","An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.","2023-11-02",0.49774,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":54,"cvssVersion":41,"severity":55,"isKev":43,"epssScore":71},"CVE-2022-23833","An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.","2022-02-03",0.49527,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":40,"cvssVersion":76,"severity":42,"isKev":43,"epssScore":77},"CVE-2019-14234","An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","2019-08-09","v3.0",0.47694,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":54,"cvssVersion":41,"severity":55,"isKev":43,"epssScore":82},"CVE-2023-23969","In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.","2023-02-01",0.47381,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":43,"epssScore":87},"CVE-2021-35042","Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.","2021-07-02",0.44369,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":92,"cvssVersion":41,"severity":93,"isKev":43,"epssScore":94},"CVE-2021-23336","The package python\u002Fcpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.","2021-02-15",5.9,"Medium",0.40736,[],[97,98,99,100],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":26},{"id":28,"product_name":29,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":30},{"id":32,"product_name":33,"version_count":25,"cve_count":25,"kev_count":11,"last_cve_update":30},{"title":102,"metaDescription":103,"keywords":104,"structuredData":105},"Djangoproject - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Djangoproject covering 4 products with 126 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Djangoproject vulnerabilities, Djangoproject security, Djangoproject CVE, Djangoproject threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":106,"@type":107,"name":108,"description":103,"url":109},"https:\u002F\u002Fschema.org","Organization","Djangoproject","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fdjangoproject",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":111,"apiVersion":112},"2026-10-17T03:52:01.755Z","3.0"]