CVE-2026-93456 — django-page-cms through 2.0.13 CSRF via admin mutation views
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Sig…
Published: 2026-09-18 · CVSS: 8.4 · CVSS 4.0
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7