PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

PYSEC-2021-103

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

CVE-2021-32681 Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

CVE-2021-32681

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the "% includeblock %" template tag is used to output the value of a plain-text StreamField block...

CVE-2021-32681

CVE-2021-32681 affects Wagtail (Django-based CMS). The issue is a cross-site scripting (XSS) vulnerability in the use of the {% include_block %} template tag to render plain-text StreamField blocks (CharBlock/TextBlock or derived blocks) without a specified template, where output is not HTML-esca...

CVE-2021-32681: Improper Neutralization of Input During Web Page Generation

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the % includeblock % template tag is used to output the value of a plain-text StreamField block...

Torchbox Wagtail 跨站脚本漏洞

Torchbox Wagtail is an open source content management system CMS from Torchbox, UK. Wagtail suffers from a cross-site scripting vulnerability that stems from tag output not being properly escaped as HTML, which allows users to insert arbitrary HTML or script...

PT-2021-19853

Name of the Vulnerable Software and Affected Versions Wagtail versions 2.13 through 2.13.1 Wagtail versions 2.12 through 2.12.4 Wagtail versions prior to 2.11.8 Description A cross-site scripting issue exists when the % include block % template tag is used to output the value of a plain-text...

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Impact When saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs...

GHSA-WQ5H-F9P5-Q7FX Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Impact When saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with javascript: URLs...

Cross-site Scripting (XSS)

wagtail is vulnerable to cross-site scripting. Lack of proper check for valid URL allows a malicious user with access to the admin interface to send a malicious POST request to publish content with javascript: URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary sit...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

Code injection

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

PYSEC-2021-114

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

PYSEC-2021-114

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434 Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail (a Django-based CMS) has a vulnerability in rich-text links where server-side checks do not enforce a valid protocol, allowing a malicious admin user to publish content containing javascript: URLs. Affected versions can be exploited via admin POST requests; an ordinary site visitor cannot...