CyberSecBulletin

DjangoCRM vulnerabilities

We track 2 vulnerabilities in DjangoCRM products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.

2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score

Latest DjangoCRM vulnerabilities

  • 8.1 High severity

    django-crm: Improper Neutralization of Special Elements Used in a Template Engine

    CVE-2026-71239DjangoCRM

    DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content d

  • 9.1 Critical severity

    django-crm: Use of Hard-coded Credentials

    CVE-2026-71238DjangoCRM

    DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the