Exposure of Django
Web frameworks58
exposure score
25,842
sites use
0
exploited
2
critical
Vexday analysis
O histórico de vulnerabilidades catalogadas para o Django totaliza 33 CVEs, das quais nenhuma consta atualmente no catálogo CISA KEV, taxa abaixo da média geral do catálogo — o que indica ausência de exploração ativa confirmada no momento. Ainda assim, o volume recente merece atenção: 13 CVEs surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes. O tipo de falha mais comum é CWE-89 (injeção de SQL), e a CVE mais perigosa ativa hoje, CVE-2025-64459, apresenta EPSS de 0,1914 — probabilidade não desprezível de exploração que, somada às 2 CVEs de severidade crítica no portfólio, recomenda atenção contínua ao ciclo de atualização em ambientes que utilizam o framework.
CVEs
40 resultsCVE-2025-64459CRITICALPotential SQL injection via _connector keyword argument in QuerySet and Q objectsEPSS 19.4%CVE-2025-57833HIGHAn issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection iEPSS 15.7%CVE-2025-32873MEDIUMAn issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is EPSS 15.3%CVE-2026-1207MEDIUMPotential SQL injection via raster lookups on PostGISEPSS 13.0%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.1%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2024-56374MEDIUMAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strinEPSS 1.9%CVE-2025-27556MEDIUMAn issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, djangEPSS 1.0%CVE-2026-1285HIGHPotential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsEPSS 1.0%CVE-2025-14550HIGHPotential denial-of-service vulnerability via repeated headers when using ASGIEPSS 1.0%CVE-2025-13372MEDIUMPotential SQL injection in FilteredRelation column aliases on PostgreSQLEPSS 0.9%CVE-2026-33033MEDIUMPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadEPSS 0.9%CVE-2025-59682LOWAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, uEPSS 0.9%CVE-2026-1312MEDIUMPotential SQL injection via QuerySet.order_by and FilteredRelationEPSS 0.8%CVE-2025-26699MEDIUMAn issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrEPSS 0.8%CVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.8%CVE-2026-1287MEDIUMPotential SQL injection in column aliases via control charactersEPSS 0.8%CVE-2026-25673HIGHPotential denial-of-service vulnerability in URLField via Unicode normalization on WindowsEPSS 0.7%CVE-2025-13473MEDIUMUsername enumeration through timing difference in mod_wsgi authentication handlerEPSS 0.7%CVE-2025-48432MEDIUMAn issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escapeEPSS 0.6%