CVE-2026-52021

The code100xDevs 100xdevs CMS v.1.0 (2026-04-30) is affected by a vulnerability that allows a remote attacker to obtain sensitive information . The flaw exists within the src/middleware.ts and src/app/api/mobile/search/route.ts components. While the vulnerability is documented with a HIGH base se...

PT-2026-80224

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

PT-2026-83654

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/ table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

PT-2026-80315

Summary The structure-board endpoint render object structure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render page, but the structure endpoint does not, allowing a low-privileged staff...

CVE-2026-54624: Improper Authorization

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-61663: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-54625: Acceptance of Extraneous Untrusted Data With Trusted Data

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-63003: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

PT-2026-80240

Impact The only authorization gate on the duplicate flow is PageAdmin.has add permission, which checks user can add pageuser, site / user can add subpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...

PT-2026-79095

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...

PT-2026-79094

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description The render object structure function fails to properly authorize non-PageContent objects that utilize PlaceholderRelationField. An active staff user lacking cms.use structure or model-level view o...

CVE-2026-75526: Improper Neutralization of Input During Web Page Generation

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

PT-2026-79101

Name of the Vulnerable Software and Affected Versions django CMS versions 5.0.8 through 5.0.8 Description In edit mode, the ContentRenderer.render placeholder function in cms/plugin rendering.py can pass stored, attacker-controlled values to the ContentRenderer.render exception function when plug...

CVE-2026-54623: Uncontrolled Recursion

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

PT-2026-83652

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...

PT-2026-79092

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The render object structure function in cms/views.py renders cms/toolbar/structure.html for a PageContent object without verifying permissions via the user can view page function. When CMS...

PT-2026-80786

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

PT-2026-79093

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 django CMS version 5.1.0a1 Description The page cache in cms/cache/page.py ignores request headers declared by plugins through the get vary cache on function. While the page cache key function includes the...