Vulnerabilidades do Batiste Django-page-cms
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Batiste Django-page-cms: 2 registro(s), com versões afetadas e correções.
CVE-2026-93456
Alta · 8.2
CWE-352 17/09/2026
django-page-cms through 2.0.13 CSRF via admin mutation views
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
CVE-2026-93455
Média · 6.5
CWE-862 17/09/2026
django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.