CVE-2025-48383

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-402CWE-918

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-483848.0Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations andCVE-2025-483858.6Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations andCVE-2025-483866.3Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations andCVE-2025-483878.7tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outsCVE-2025-483886.5FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of CVE-2025-483897.2FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusCVE-2025-48398.1A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability iCVE-2025-483907.2FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insCVE-2025-483917.5In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in APICVE-2025-483927.5A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recomCVE-2025-483935.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacCVE-2025-483944.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited