https://reddit.com/r/netsec/comments/1vg9704/stored_xss_in_djangos_admin_via_an_unvalidated/: Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)
Published Aug 5, 2026
·Updated
Affected Software
1 affected component
Django Django
Frequently Asked Questions
1
What is the severity of CVE-2026-15920?
CVE-2026-15920 is considered a high severity vulnerability due to its ability to allow stored cross-site scripting (XSS) attacks.
2
How do I fix CVE-2026-15920?
To fix CVE-2026-15920, ensure your Django installation is updated to the latest version where this vulnerability is patched.
3
What impact does CVE-2026-15920 have on Django applications?
CVE-2026-15920 can allow an attacker to inject malicious scripts into Django's admin interface, compromising the security of the application.
4
Is CVE-2026-15920 present in all versions of Django?
Yes, CVE-2026-15920 affects multiple versions of Django prior to the release of the patch in the latest versions.
5
What are the signs of exploitation of CVE-2026-15920?
Signs of exploitation of CVE-2026-15920 may include unexpected script behavior, authentication bypass, or unauthorized access to sensitive information in the admin dashboard.