Ali İltizar

**Name of the Vulnerable Software and Affected Versions** Wagtail CMS version 6.4.1 **Description** The issue is related to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. **Recommendations** For Wagtail CMS version 6.4.1, as a temporary workaround, consider restricting the upload of PDF files or disabling the document upload functionality until a patch is available. Avoid using the affected document upload feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** django Filer versions 3.0 through 3.2 **Description** The issue is related to an Unrestricted Upload of File with Dangerous Type, Improper Input Validation, and Improper Neutralization of Script-Related HTML Tags in a Web Page, which can lead to Stored XSS. This allows input data manipulation. **Recommendations** For django Filer versions 3.0 through 3.2, update to version 3.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** django CMS versions prior to 4.0 **Description** The issue is related to improper neutralization of input during web page generation, leading to a Cross-site Scripting (XSS) vulnerability. This allows for stored XSS attacks. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `django CMS Attributes Fields` to minimize the risk of exploitation. Avoid using the vulnerable fields until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: django-cms versions 3.11.7 through 3.11.8 django-cms versions 4.1.2 through 4.1.3 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This can be exploited by a remote attacker to conduct an XSS attack. The vulnerability is associated with the failure to protect the structure of web pages. Technical details include the exploitation of the Page Title field in the Page Creation interface, allowing JavaScript injection. Recommendations: For django-cms versions 3.11.7 and 3.11.8, update to a version that includes the fix for this issue. For django-cms versions 4.1.2 and 4.1.3, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Page Creation interface to minimize the risk of exploitation. Avoid using the Page Title field in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.