Riskcovery

CVE-2021-25986

Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section

State
Published
Severity
5.4 Medium
Published
Nov 23, 2021
Updated
Apr 30, 2025
Reserved
Jan 22, 2021

Read the record on cve.org

Description

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NMend

Weaknesses

  • CWE-79 Cross-site Scripting (XSS)

Affected Products

ProductVersions
Django-wikiDjango-wiki
  • 0.0.20 to before unspecifiedAffected
  • 0.7.8 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.