Batiste vulnerabilities
Published CVEs affecting Batiste products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-93456
High · 8.2
CWE-352 Sep 17, 2026
django-page-cms through 2.0.13 CSRF via admin mutation views
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
CVE-2026-93455
Medium · 6.5
CWE-862 Sep 17, 2026
django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.