Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 Stored XSS CMS Stored XSS Vulnerability PoC Overview This repository demonstrates a Stored XSS vulnerability found in the Wagtail 6.4.1 CMS platform. A malicious JavaScript is embedded in a PDF file, and every time a user clicks on the PDF, a...

terra-bonobo-nodes (>=0.1.1, <=0.1.4), terra-common (>=0.2.2, <=0.2.10) +1 more potentially affected by CVE-2026-106443 via weasyprint (57.0.0)

weasyprint PYPI version 57.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - terra-bonobo-nodes =0.1.1, =0.2.2, =0.2.10 - wagtail-meeting-guide 0.1.0.dev9 Source cves: CVE-2026-106443 Source advisory:...

ai-parrot (>=0.20.3, <=0.23.12), riskforge (>=1.1.0, <=1.1.2) +1 more potentially affected by CVE-2026-106443 via weasyprint (68.0.0)

weasyprint PYPI version 68.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.20.3, =1.1.0, =2.11.2, =2.12.0 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

django-freeradius (0.1.0), genalog (>=0.1.0rc4, <=0.1.0) +6 more potentially affected by CVE-2026-106443 via weasyprint (51.0.0)

weasyprint PYPI version 51.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - django-freeradius 0.1.0 - genalog =0.1.0rc4, =0.1.0, =0.0.8, =3.4.0, =0.0.3, =1.0.0, =1.1.1 Source cves: CVE-2026-106443 Source advisory:...

CVE-2026-88420

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

EUVD-2026-87082

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

CVE-2026-88420

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

CVE-2026-88420

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

PT-2026-98825

Name of the Vulnerable Software and Affected Versions APSL puput versions 1.2.1 through 2.2.0 Description A reflected cross-site scripting XSS issue exists in the EntryAbstract.save function. This allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code within the...

CVE-2026-88420

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

CVE-2026-88420

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput versions v1.2.1 through v2.2.0 . This flaw allows authenticated attackers possessing Wagtail Editor privileges to execute arbitrary code within a victim's browser by providing a crafted...

CVE-2026-88420: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the EntryAbstract.save component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload...

terra-bonobo-nodes (>=0.1.1, <=0.1.4), terra-common (>=0.2.2, <=0.2.10) +1 more potentially affected by CVE-2026-55073 via weasyprint (57.0.0)

weasyprint PYPI version 57.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - terra-bonobo-nodes =0.1.1, =0.2.2, =0.2.10 - wagtail-meeting-guide 0.1.0.dev9 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3...

ai-parrot (>=0.20.3, <=0.23.12), riskforge (>=1.1.0, <=1.1.2) +1 more potentially affected by CVE-2026-55073 via weasyprint (68.0.0)

weasyprint PYPI version 68.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - ai-parrot =0.20.3, =1.1.0, =2.11.2, =2.12.0 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

wagtail-liveedit (0.0.8) potentially affected by CVE-2026-55468 via wagtail (5.1.2)

wagtail PYPI version 5.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-liveedit 0.0.8 Source cves: CVE-2026-55468 Source advisory: OSV:PYSEC-2026-3939...

wagtail-liveedit (0.0.10) potentially affected by CVE-2026-55468 via wagtail (6.0.2)

wagtail PYPI version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-liveedit 0.0.10 Source cves: CVE-2026-55468 Source advisory: OSV:PYSEC-2026-3939...

coderedcms (>=0.5.0, <=0.7.1), coop (>=2.1.0b0, <=2.1.4) +3 more potentially affected by CVE-2026-55468 via wagtail (2.1.3)

wagtail PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.5.0, =2.1.0b0, =0.5.0, =0.0.2, =0.0.5 Source cves: CVE-2026-55468 Source advisory: OSV:PYSEC-2026-3939...

wagtail-liveedit (0.0.15) potentially affected by CVE-2026-55468 via wagtail (6.2.2)

wagtail PYPI version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-liveedit 0.0.15 Source cves: CVE-2026-55468 Source advisory: OSV:PYSEC-2026-3939...

coop (>=2.10.0, <=2.10.2), meine-stadt-transparent (0.2.9) +15 more potentially affected by CVE-2026-55468 via wagtail (2.10.2)

wagtail PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.10.0, =0.3.1, =0.5.4, =3.0.3, =0.23.0, =0.24.2 - wagtail-test 0.0.0 - wagtail-treemodeladmin 1.2.1 - wagtailperson 0.12.0 - wagtailpress...

coderedcms (0.17.0), coop (2.7.0) +10 more potentially affected by CVE-2026-55468 via wagtail (2.7.4)

wagtail PYPI version 2.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms 0.17.0 - coop 2.7.0 - meine-stadt-transparent 0.2.4 - texsite 2.0.0 - wagtail-copyablemodeladmin 1.0.0 - wagtail-grapple =0.4.9, =0.3.2...