Djangocrm Django-Crm
4 CVEs affecting Djangocrm Django-Crm. Latest disclosed: 2026-09-14. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71238 | Critical | 9.1 | 2026-08-05 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key… |
CVE-2026-71239 | High | 8.1 | 2026-08-05 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at leas… |
CVE-2026-90806 | Medium | 6.3 | 2026-09-14 | A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_vi… |
CVE-2026-71240 | Medium | 4.3 | 2026-08-05 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to… |