8881 matches found
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
SummaryThe moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker...
django CMS: Stored XSS in edit-mode plugin exception rendering
SummaryWhen plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short...
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
ImpactThe only authorization gate on the duplicate flow is PageAdmin.hasaddpermission,which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “maythis user create a page at all”. Nothing checks the user’s relationship to the page beingcopied:- cms/admin/forms.py —...
PYSEC-2026-3820 django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
SummaryThe django-cms frontend-editing structure endpointGET //admin/cms/placeholder/object//structure//did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a model...
PYSEC-2026-3823 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...
PYSEC-2026-3826 django CMS: Structure endpoint bypasses page-view permission
Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...
django CMS: Structure endpoint bypasses page-view permission
SummaryThe structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff user...
PYSEC-2026-3821 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
PYSEC-2026-3825 django CMS: Stored XSS in edit-mode plugin exception rendering
Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...
mobileAudit v3.2.0
Mobile Audit Security analysis for Android APKs, from upload to actionable findings. Mobile Audit is a Django application for static application security testing and malware inspection. It extracts APK metadata, detects risky implementation patterns, organizes findings by severity, and provides a...
CLSA-2026-1788940378 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post4+tuxcare...
CLSA-2026-1788934711 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post6+tuxcare...
CLSA-2026-1788934499 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post11+tuxcare...
CLSA-2026-1788933529 TuxCare security update for django (3 CVEs)
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post7+tuxcare...
CLSA-2026-1788933480 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post11+tuxcare...
PT-2026-95815
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post4+tuxcare...