tendenci vulnerabilities
CVEs whose affected-version data names the tendenci package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2025-70960Medium· 5.4A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web …
A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
▾ Sunlittendenci · tendenciEPSS 0.27%via OSV
CVE-2020-36962Critical· 9.8PoCTendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in t…
▾ Abyssaltendenci · tendenciEPSS 12%via NVD
CVE-2026-23946Medium· 6.8Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
▾ Sunlittendenci · tendenciEPSS 0.84%via OSV