Vulnerabilities

TI-2026-52882 CVE-2026-75526 · GHSA-hvq6-2r72-p2x7

django CMS: Stored XSS in edit-mode plugin exception rendering

LOW 20

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00261 Published 2026-08-20 Fixed in 5.0.9 CWE-79

TI-2026-45004 CVE-2026-63003 · GHSA-6x92-6vx4-5fwr

Authorization bypass in django-cms

LOW 29

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-20 Fixed in 5.0.9 CWE-639

TI-2026-44152 CVE-2026-61663 · GHSA-8qj2-c6q4-f399

Authorization bypass in django-cms

MEDIUM 53

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-08-20 Fixed in 5.0.9 CWE-639

TI-2026-39453 CVE-2026-54622 · GHSA-4xfr-4p46-gc6p

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

LOW 29

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-20 Fixed in 5.0.8 CWE-639

TI-2026-39455 CVE-2026-54624 · GHSA-vgxm-h9gx-h9w7

django CMS: Structure endpoint bypasses page-view permission

LOW 29

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-20 Fixed in 5.0.8 CWE-285

TI-2026-39454 CVE-2026-54623 · GHSA-8jj7-4v57-frf5

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

LOW 32

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00487 Published 2026-08-20 Fixed in 5.0.8 CWE-674

TI-2026-39456 CVE-2026-54625 · GHSA-fwjf-m4qw-9f2x

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

LOW 21

django CMS is a content management system powered by Django.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.0018 Published 2026-08-20 Fixed in 5.0.8, 5.1.0 CWE-349

TI-2024-10485 CVE-2024-11319 · GHSA-gv5h-5655-h4mv

Stored XSS in Open Source Project "django-cms"

MEDIUM 55

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00537 Published 2024-11-18 Fixed in 4.1.4, 3.11.9 CWE-79

TI-2021-20186 CVE-2021-44649 · GHSA-hx7c-qpfq-xcrp

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error…

LOW 25

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00638 Published 2022-01-12 Fixed in 3.7.4, 3.6.1 +2 CWE-79

TI-2015-04262 CVE-2015-5081 · GHSA-2pqc-gv8q-pvqv

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before…

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01036 Published 2017-08-18 Fixed in 3.0.14, 3.1.1 CWE-352

Vulnerabilities

Filters