Skip to content
OpenAdvisories

Vendor

DjangoCRM

4 known vulnerabilities.

Products

django-crm 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-71238

    DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

    DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the…

    DjangoCRM django-crm