CVE-2017-12794

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.

• CWE-79

• http://www.securityfocus.com/bid/100643Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039264Third Party Advisory, VDB Entry
• https://usn.ubuntu.com/3559-1/
• https://www.djangoproject.com/weblog/2017/sep/05/security-releases/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/100643Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039264Third Party Advisory, VDB Entry
• https://usn.ubuntu.com/3559-1/
• https://www.djangoproject.com/weblog/2017/sep/05/security-releases/Patch, Vendor Advisory

Published

Sep 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12788Multiple cross-site scripting (XSS) vulnerabilities in admin…
• CVE-2017-12789Metinfo 5.3.18 is affected by: Cross Site Request Forgery (C…
• CVE-2017-1279IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could al…
• CVE-2017-12790Metinfo 5.3.18 is affected by: Cross Site Request Forgery (C…
• CVE-2017-12791Directory traversal vulnerability in minion id validation in…
• CVE-2017-12792Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2017-12795OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (…
• CVE-2017-12796The Reporting Compatibility Add On before 2.0.4 for OpenMRS,…
• CVE-2017-12797Integer overflow in the INT123_parse_new_id3 function in the…
• CVE-2017-12798Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 v…
• CVE-2017-12799The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29…
• CVE-2017-1280IBM Rational Quality Manager and IBM Rational Collaborative …5.4