Threats tagged 'ghsa-mr54-mm5f-7jw3'

DjangoBlog versions 2.0.0.0 through 2.1.0.0 contain a stored cross-site scripting (XSS) vulnerability. The issue arises because the class_filter comment sanitizer improperly allows event-handler attributes on certain HTML tags, enabling authenticated commenters to inject scripts that execute automatically when a page is viewed, including by administrators.