GCVE - cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*

part: a version: 1.10.6 update: *

Vendor	Djangoproject (`070db687-4713-5da4-80b0-4a67baf0d0d4`)
Product	Django (`b34a5fd0-fae8-5096-941f-bded7e4dd228`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/django/django`	purl2cpe	2026-06-01 10:17:26.721572
`pkg:github/django/django`	purl2cpe	2026-06-01 10:17:26.721574
`pkg:pypi/django`	purl2cpe	2026-06-01 10:17:26.721576

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7234`	vulnerable	2026-06-08 05:09:55.522728	Details available A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.057Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 http://www.securityfocus.com/bid/97401 http://www.debian.org/security/2017/dsa-3835 https://www.djangoproject.com/weblog/2017/apr/04/security-releases/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7233`	vulnerable	2026-06-08 05:09:55.521225	Details available Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. Published: 2017-04-04T17:00:00.000Z Updated: 2024-08-05T15:56:36.158Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038177 https://access.redhat.com/errata/RHSA-2017:1596 http://www.securityfocus.com/bid/97406 https://access.redhat.com/errata/RHSA-2017:3093 http://www.debian.org/security/2017/dsa-3835	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12794`	vulnerable	2026-06-08 05:08:47.893421	Details available In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. Published: 2017-09-07T13:00:00.000Z Updated: 2024-08-05T18:51:07.127Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/3559-1/ http://www.securityfocus.com/bid/100643 http://www.securitytracker.com/id/1039264 https://www.djangoproject.com/weblog/2017/sep/05/security-releases/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.