Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Django Number Of NVD 120 CRITICAL 10 HIGH 35 MEDIUM 70 LOW 5
URL https://www.djangoproject.com/
Explanation It is a web application framework written in Python.

Django uses the "A.B.C" format for versioning.

A.B" is for feature releases, and "C" is for patches, which are used for bug fixes and security fixes.

Feature releases are released at intervals of about eight months.
There are releases that are covered by long-term support, such as security releases, which are guaranteed for three years.
Long-term support covers

A.2".

A.2" is the version with ".2".
Tag
  • BSD License
  • Python
  • オープンソース

Add Information URL
No Type Name URL
1 https://www.djangoproject.com/download/
2 https://djangoproject.jp/
3 https://docs.djangoproject.com/en/dev/internals/release-process/
4 https://github.com/django/django

List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support
Extended
for a fee
Critical High Medium Low
101 Django6.0 6.0.6 June 3, 2026 Dec. 3, 2025 Aug. 31, 2026 April 30, 2027 0 0 0 0
102 Django5.0 5.0.14 April 2, 2025 Dec. 4, 2023 Aug. 31, 2022 April 30, 2025 0 4 1 0
103 Django4.2 LTS 4.2.26 Nov. 5, 2025 April 1, 2023 Dec. 31, 2023 April 30, 2026 2 10 2 1
104 Django4.1 4.1.13 Nov. 1, 2023 Aug. 1, 2022 April 30, 2023 Dec. 31, 2023 1 7 0 0
105 Django4.0 4.0.10 Feb. 14, 2023 Dec. 1, 2021 Aug. 31, 2022 April 30, 2023 4 8 2 0
106 Django3.2 LTS 3.2.25 March 4, 2024 April 6, 2021 Dec. 31, 2021 April 30, 2024 5 15 4 0
107 Django3.1 3.1.13 July 1, 2021 Aug. 4, 2020 April 30, 2021 Dec. 31, 2021 1 5 5 0
108 Django3.0 3.0.14 April 6, 2021 Dec. 2, 2019 Aug. 31, 2020 April 30, 2021 2 4 6 0
109 Django2.2 LTS 2.2.28 April 11, 2022 April 1, 2019 Dec. 2, 2019 April 30, 2022 5 12 12 0
110 Django2.1 2.1.15 Dec. 2, 2019 Aug. 1, 2018 April 1, 2019 Dec. 2, 2019 1 4 6 0
111 Django2.0 LTS 2.0.9 Feb. 12, 2019 Dec. 3, 2017 Aug. 1, 2018 April 1, 2019 0 2 5 0
112 Django1.11 LTS 1.11.29 March 4, 2020 April 5, 2017 April 1, 2017 April 1, 2020 3 6 8 0
113 Django1.9 1.9.13 April 1, 2017 Dec. 1, 2015 Aug. 31, 2016 April 30, 2017 4 8 12 1
114 Django1.8 1.8.19 March 6, 2018 April 2, 2015 Dec. 1, 2015 April 1, 2018 2 5 14 1
115 Django1.7 1.7.11 Nov. 24, 2015 Sept. 2, 2014 Jan. 1, 1900 1 3 20 1
116 Django1.6 1.6.11 March 18, 2015 Nov. 6, 2013 Jan. 1, 1900 1 3 22 1
117 Django1.5 1.5.12 Jan. 2, 2015 Feb. 26, 2013 Jan. 1, 1900 1 3 19 1
118 Django1.4 1.4.22 Aug. 18, 2015 March 23, 2012 Jan. 1, 1900 1 3 28 1
119 Django1.3 1.3.7 Feb. 20, 2013 March 23, 2011 Jan. 1, 1900 1 2 28 1
120 Django1.2 1.2.7 Sept. 10, 2011 May 17, 2010 Jan. 1, 1900 1 3 28 1
121 Django1.2-alpha1 1.2-alpha1 Jan. 1, 1900 Jan. 1, 1900 0 0 4 0
122 Django1.10 1.10.8 Jan. 1, 1900 April 30, 2017 Nov. 30, 2017 2 1 5 0
123 Django1.1 1.1.4 Jan. 1, 1900 Jan. 1, 1900 2 5 33 1
124 Django1.0 1.0.2 Jan. 1, 1900 Jan. 1, 1900 1 2 26 1
125 Django0.96 0.96 Jan. 1, 1900 Jan. 1, 1900 1 2 25 1
126 Django0.95 0.95 July 1, 2006 Jan. 1, 1900 1 2 25 1
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2
Level
Attach Vector
Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date
Show Affected Exploit
PoC
Search
101 -
5.0
MEDIUM The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption)… CWE-287
Improper Authentication
CVE-2013-1443 cpe:2.3:a:djangoproject:django:1.6:beta3
cpe:2.3:a:djangoproject:django:1.6:beta2
cpe:2.3:a:djangoproject:django:…
2024-11-21 10:49
2013-09-24
Show GitHub Exploit DB Packet Storm
102 -
5.0
MEDIUM Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_… CWE-22
Path Traversal
CVE-2013-4315 cpe:2.3:a:djangoproject:django:1.6:beta2
cpe:2.3:a:djangoproject:django:1.6:beta1
cpe:2.3:a:djangoproject:django:…
2024-11-21 10:55
2013-09-17
Show GitHub Exploit DB Packet Storm
103 -
5.0
MEDIUM The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of ser… CWE-189
Numeric Errors
CVE-2013-0306 cpe:2.3:a:djangoproject:django:1.5:beta
cpe:2.3:a:djangoproject:django:1.5:alpha
cpe:2.3:a:djangoproject:django:1…
2024-11-21 10:47
2013-05-2
Show GitHub Exploit DB Packet Storm
104 -
4.0
MEDIUM The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated a… CWE-200
Information Exposure
CVE-2013-0305 cpe:2.3:a:djangoproject:django:1.5:beta
cpe:2.3:a:djangoproject:django:1.5:alpha
cpe:2.3:a:djangoproject:django:1…
2024-11-21 10:47
2013-05-2
Show GitHub Exploit DB Packet Storm
105 -
6.4
MEDIUM The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host… CWE-20
 Improper Input Validation 
CVE-2012-4520 cpe:2.3:a:djangoproject:django:1.4:*
cpe:2.3:a:djangoproject:django:1.4.1:*
cpe:2.3:a:djangoproject:django:1.3:be…
2024-11-21 10:43
2012-11-19
Show GitHub Exploit DB Packet Storm
106 -
5.0
MEDIUM The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows re… CWE-119
Incorrect Access of Indexable Resource ('Range Error') 
CVE-2012-3444 cpe:2.3:a:djangoproject:django:1.4:*
cpe:2.3:a:djangoproject:django:1.3:beta1
cpe:2.3:a:djangoproject:django:1.3:…
1.3 2024-11-21 10:40
2012-08-1
Show GitHub Exploit DB Packet Storm
107 -
5.0
MEDIUM The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a… CWE-20
 Improper Input Validation 
CVE-2012-3443 cpe:2.3:a:djangoproject:django:1.4:*
cpe:2.3:a:djangoproject:django:1.3:beta1
cpe:2.3:a:djangoproject:django:1.3:…
1.3 2024-11-21 10:40
2012-08-1
Show GitHub Exploit DB Packet Storm
108 -
4.3
MEDIUM The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which… CWE-79
Cross-site Scripting
CVE-2012-3442 cpe:2.3:a:djangoproject:django:1.4:*
cpe:2.3:a:djangoproject:django:1.3:beta1
cpe:2.3:a:djangoproject:django:1.3:…
1.3 2024-11-21 10:40
2012-08-1
Show GitHub Exploit DB Packet Storm
109 -
6.8
MEDIUM The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers … CWE-352
 Origin Validation Error
CVE-2011-4140 cpe:2.3:a:djangoproject:django:1.3:alpha2
cpe:2.3:a:djangoproject:django:1.3:alpha1
cpe:2.3:a:djangoproject:djang…
1.2.6 2024-11-21 10:31
2011-10-19
Show GitHub Exploit DB Packet Storm
110 -
5.0
MEDIUM Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a c… CWE-20
 Improper Input Validation 
CVE-2011-4139 cpe:2.3:a:djangoproject:django:1.3:alpha2
cpe:2.3:a:djangoproject:django:1.3:alpha1
cpe:2.3:a:djangoproject:djang…
1.2.6 2024-11-21 10:31
2011-10-19
Show GitHub Exploit DB Packet Storm