Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2011-0698 Directory traversal in DjangoCVE-2012-3442 The (1) django.http.HttpResponseRedirect and (2) django.http.HttpRespo ...CVE-2014-0472 python-django: unexpected code execution using reverse()CVE-2019-19844 Django: crafted email address allows account takeoverCVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)CVE-2025-64459 django: Django SQL injectionCVE-2010-4534 The administrative interface in django.contrib.admin in Django before ...CVE-2011-0696 Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly val ...CVE-2011-4137 The verify_exists functionality in the URLField implementation in Djan ...CVE-2011-4138 The verify_exists functionality in the URLField implementation in Djan ...CVE-2011-4139 Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host ...CVE-2012-3443 The django.forms.ImageField class in the form system in Django before ...CVE-2012-3444 The get_image_dimensions function in the image-handling functionality ...CVE-2014-0473 python-django: caching of anonymous pages could reveal CSRF tokenCVE-2014-0474 python-django: MySQL typecastingCVE-2014-0480 Django: reverse() can generate URLs pointing to other hosts, leading to phishing attacksCVE-2014-0481 Django: file upload denial of serviceCVE-2015-0221 Django: denial of service attack against django.views.static.serveCVE-2015-5143 Django: possible DoS by filling session storeCVE-2015-5144 Django: possible header injection due to validators accepting newlines in inputCVE-2016-7401 python-django: CSRF protection bypass on a site with Google AnalyticsCVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliasesCVE-2025-64458 Django: Denial-of-service vulnerability in Django on WindowsCVE-2010-3082 Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 ...Your dependencies cross-checked against the OSV vulnerability database.
PYSEC-2011-12 Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cPYSEC-2012-2 The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which PYSEC-2014-1 The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary PythoPYSEC-2014-3 The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properlPYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.GHSA-hmr4-m2h5-33qx SQL injection in DjangoPYSEC-2011-12 Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cPYSEC-2012-2 The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which PYSEC-2014-1 The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary PythoPYSEC-2014-3 The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properlPYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.GHSA-hmr4-m2h5-33qx SQL injection in DjangoPYSEC-2010-12 Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.PYSEC-2011-1 django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which aPYSEC-2011-10 Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site requPYSEC-2011-11 Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file uPYSEC-2011-2 The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which aPYSEC-2011-3 The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for tPYSEC-2011-4 Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crPYSEC-2011-5 The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers tPYSEC-2011-8 The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain objecPYSEC-2011-9 The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestampPYSEC-2012-3 The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.