CyberRota Analysis
AI-GeneratedDjango-page-cms versions up to 2.0.13 are vulnerable due to insufficient CSRF protection on five admin mutation views, allowing attackers to forge requests that modify page content. This flaw can lead to stored cross-site scripting attacks, where signed-in editors may inadvertently store malicious content that affects all site visitors. Organizations using this CMS should prioritize patching to mitigate the risk of content manipulation and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.