Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-93456

django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Batiste
Products
Django-page-cms
CVE-2026-93455

django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Batiste
Products
Django-page-cms