Tendenci

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Tendenci records in CISA KEV

No Tendenci vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tendenci 5 records MEDIUM Cms 1 record LOW

Records

5 records in Tendenci · all components

TI-2020-19097 CVE-2020-36962 · GHSA-4q3w-jgfx-4792

Tendenci 12.3.1 - CSV/ Formula Injection

MEDIUM 63

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.12363 Published 2026-01-28 Fixed in 12.3.2 CWE-1236

TI-2025-43174 CVE-2025-70960 · GHSA-6fvp-wmh6-jg95

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2026-02-02 No fix listed CWE-79

TI-2025-43173 CVE-2025-70959 · GHSA-g7hj-29xq-r64w

A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2026-02-02 No fix listed CWE-79

TI-2020-11752 CVE-2020-14942 · GHSA-jqmc-fxxp-r589

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

MEDIUM 45

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01384 Published 2020-06-21 Fixed in 12.0.11 CWE-502

TI-2026-19288 CVE-2026-23946 · GHSA-339m-4qw5-j2g3

Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

LOW 34

Tendenci is an open source content management system built for non-profits, associations and cause-based sites.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00837 Published 2026-01-22 Fixed in 15.3.12 CWE-502

Open these records in search →

Critical	1
High	0
Medium	5
Low	0
No CVSS	0