CVE-2026-93456 in django-page-cms
الملخص
بحسب MITRE • 18/09/2026
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.