Djangocrm Django-crm
3 CVEs affecting Djangocrm Django-crm. Latest disclosed: 2026-08-05. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71238 | Critical | 9.1 | 2026-08-05 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key… |
CVE-2026-71239 | High | 8.1 | 2026-08-05 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at le… |
CVE-2026-71240 | Medium | 4.3 | 2026-08-05 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to… |