CVE Feed

    Dashboard / CVE / CVE-2013-4249

    CVE-2013-4249

    Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.

    Published:Oct 4, 2013
    Last Modified:Apr 11, 2025
    EPS:Oct 4, 2013
    EPSS Score:0.00279
    CVSS Score:4.3

    Affected Products

    Vendor
    Djangoproject
    Product
    Django

    Exploits

    https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560

    Related CVEs

    CVE-2026-15920 (CVSS 5.1) — An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_…
    CVE-2026-15830 (CVSS 6.9) — An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos…
    CVE-2026-15337 (CVSS 6.9) — An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_…
    CVE-2026-15307 (CVSS 8.7) — An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistic…
    CVE-2026-53877 (CVSS 6.3) — An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster`…
    CVE-2026-53878 (CVSS 5.3) — An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohi…
    CVE-2026-48588 (CVSS 2.3) — An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cac…
    CVE-2026-48587 (CVSS 2.3) — An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header(…
    CVE-2026-35193 (CVSS 2.3) — An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCache…
    CVE-2026-8404 (CVSS 2.3) — An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCache…

    References

    http://seclists.org/oss-sec/2013/q3/369
    http://seclists.org/oss-sec/2013/q3/411
    http://secunia.com/advisories/54476
    http://www.securitytracker.com/id/1028915
    https://exchange.xforce.ibmcloud.com/vulnerabilities/86438
    https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78
    https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560
    https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued
    http://seclists.org/oss-sec/2013/q3/369
    http://seclists.org/oss-sec/2013/q3/411
    http://secunia.com/advisories/54476
    http://www.securitytracker.com/id/1028915
    https://exchange.xforce.ibmcloud.com/vulnerabilities/86438
    https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78
    https://github.com/django/django/commit/cbe6d5568f4f5053ed7228ca3c3d0cce77cf9560
    https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High