Vulnerabilities

TI-2024-10485 CVE-2024-11319 · GHSA-gv5h-5655-h4mv

Stored XSS in Open Source Project "django-cms"

MEDIUM 55

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00537 Published 2024-11-18 Fixed in 4.1.4, 3.11.9 CWE-79

TI-2021-20186 CVE-2021-44649 · GHSA-hx7c-qpfq-xcrp

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error…

LOW 25

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00638 Published 2022-01-12 Fixed in 3.7.4, 3.6.1 +2 CWE-79

TI-2015-04262 CVE-2015-5081 · GHSA-2pqc-gv8q-pvqv

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before…

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01036 Published 2017-08-18 Fixed in 3.0.14, 3.1.1 CWE-352

Vulnerabilities

Filters

Stored XSS in Open Source Project "django-cms"

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error…

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before…