CVE-2022-21683

Wagtail CVE-2022-21683 affects the notification logic for new replies in comment threads. The issue caused notifications to be sent to all users who have commented or replied anywhere on the site, rather than only to participants within the active thread. This could allow users without editing ac...

Torchbox Wagtail 信息泄露漏洞

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Torchbox Wagtail, a Django-based content management system focused on flexibility and user experience. When notifications of new replies are sent in comment threads, they are sent...

Cross-Site Scripting (XSS)

wagtail is vulnerable to cross-site scripting. Lack of proper escaping of HTML in Wagtail StreamField blocks CharBlock , TextBlock or a similar user-defined block derived from FieldBlock allows a user with ability to author StreamField content to inject and execute arbitrary Javascript in a user'...

GHSA-XFRW-HXR5-GHQF Cross-site Scripting in wagtail

Impact When the % includeblock % template tag is used to output the value of a plain-text StreamField block CharBlock, TextBlock or a similar user-defined block derived from FieldBlock, and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This...

Cross-site Scripting in wagtail

Impact When the % includeblock % template tag is used to output the value of a plain-text StreamField block CharBlock, TextBlock or a similar user-defined block derived from FieldBlock, and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This...

CVE-2021-32681

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

CVE-2021-32681

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

Cross site scripting

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

CVE-2021-32681

CVE-2021-32681 affects Wagtail (Django-based CMS). The issue is a cross-site scripting (XSS) vulnerability in the use of the {% include_block %} template tag to render plain-text StreamField blocks (CharBlock/TextBlock or derived blocks) without a specified template, where output is not HTML-esca...

CVE-2021-32681 Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

Torchbox Wagtail 跨站脚本漏洞

Torchbox Wagtail is an open source content management system CMS from Torchbox, UK. Wagtail suffers from a cross-site scripting vulnerability that stems from tag output not being properly escaped as HTML, which allows users to insert arbitrary HTML or script...

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Impact When saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs...

GHSA-WQ5H-F9P5-Q7FX Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Impact When saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs...

Cross-site Scripting (XSS)

wagtail is vulnerable to cross-site scripting. Lack of proper check for valid URL allows a malicious user with access to the admin interface to send a malicious POST request to publish content with javascript: URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary sit...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

PYSEC-2021-114

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

Code injection

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...