Djangosige
Approved changes feed: RSS · Atom
cpe:2.3:a:thiagopena:djangosige:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Thiagopena (7fb82462-1cc0-5829-9130-105f22d0b151) |
|---|---|
| Product | Djangosige (0fddcefd-efc5-5ae1-bd6d-bf45b399c71f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-64822 |
vulnerable | 2026-07-29 01:06:19.877927 |
djangoSIGE 1.10 User Enumeration via ForgotPasswordView
MEDIUM (5.3)
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
Published: 2026-07-21T20:28:03.702Z
Updated: 2026-11-08T14:07:59.256Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-64821 |
vulnerable | 2026-07-29 01:06:19.877593 |
djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
MEDIUM (4.3)
djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.
Published: 2026-07-21T20:31:35.885Z
Updated: 2026-11-08T14:07:58.549Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.