CVE-2026-93456NVD

Vulnerability Summary

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

Severity Level

HIGH(8.2)

Published Date

Sep 18, 2026

Last Modified

Sep 21, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.15%Probability

Root Weakness (CWE)

CWE-352: Cross-Site Request Forgery (CSRF) ↗

The web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVSS v4.0 Base Metrics — Score 8.4 (HIGH)

Attack VectorNetwork

Attack ComplexityLow

Attack RequirementsNone

Privileges RequiredNone

User InteractionPassive

Confidentiality (Vulnerable System)Low

Integrity (Vulnerable System)High

Availability (Vulnerable System)None

Confidentiality (Subsequent System)Low

Integrity (Subsequent System)High

Availability (Subsequent System)None

CVSS v3.1 Base Metrics — Score 8.2 (HIGH)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeChanged

ConfidentialityLow

IntegrityHigh

AvailabilityNone

Affected & Patched Versions

Affected Versions

batiste django-page-cms <= 2.0.13

Patched Versions

batiste django-page-cms 2.0.13

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.