Vulnerability record · CVE-2017-12794 · published 7 September 2017

CVE-2017-12794: Djangoproject django cross-site scripting vulnerability

Djangoproject · Django

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

6.1 CVSS 3.0 Medium EPSS 24% · top 2.3% CWE-79 · Cross-site scripting

6.1CVSS 3.0 base score, v2 4.3

24%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Django Djangoproject

References

Link	Tags
http://www.securityfocus.com/bid/100643	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039264	Third Party AdvisoryVDB Entry
https://usn.ubuntu.com/3559-1/
https://www.djangoproject.com/weblog/2017/sep/05/security-releases/	PatchVendor Advisory
http://www.securityfocus.com/bid/100643	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039264	Third Party AdvisoryVDB Entry
https://usn.ubuntu.com/3559-1/
https://www.djangoproject.com/weblog/2017/sep/05/security-releases/	PatchVendor Advisory

Track CVE-2017-12794 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2014-0474Canonical ubuntu linux vulnerabilityThe (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x befor…EPSS 4.9%23 Apr 2014 9.8CVE-2026-4277Djangoproject django missing authorization vulnerabilityAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated o…EPSS 0.60%7 Apr 2026 9.8CVE-2025-59681Djangoproject django sql injection vulnerabilityAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggrega…EPSS 0.63%1 Oct 2025 9.8CVE-2024-53908Djangoproject django sql injection vulnerabilityAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey…EPSS 1.4%6 Dec 2024 9.8CVE-2023-31047Djangoproject django improper input validation vulnerabilityIn Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multipl…EPSS 1.4%7 May 2023 9.8CVE-2022-34265Django Trunc() and Extract() database functions SQL injectionDjango 3.2 before 3.2.14 and 4.0 before 4.0.6 allow SQL injection when untrusted data is passed as the kind or lookup_name argument to the Trunc() an…EPSS 74%analysed4 Jul 2022 9.8CVE-2022-28347Djangoproject django sql injection vulnerabilityA SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passi…EPSS 2.9%12 Apr 2022 9.8CVE-2022-28346Djangoproject django sql injection vulnerabilityAn issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods a…EPSS 19%12 Apr 2022

Source: NIST National Vulnerability Database (record CVE-2017-12794), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.