Skip to content
OpenAdvisories

Package · PyPI

tendenci

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 5.4
    CVE-2025-70959

    Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module

    A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

    tendenci PyPI
  • Medium 5.4
    CVE-2025-70960

    Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module

    A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

    tendenci PyPI
  • Critical 9.8
    CVE-2020-36962 EPSS 12%

    Tendenci 12.3.1 - CSV/ Formula Injection

    Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to tr…

    tendenci tendenci tendenci PyPI
  • Medium 6.8
    CVE-2026-23946

    Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

    Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerab…

    tendenci tendenci tendenci PyPI
  • Critical 9.8
    CVE-2020-14942

    Deserialization of Untrusted Data in Tendenci

    Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

    tendenci PyPI