CVE-2018-25045

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8Patch, Third Party Advisory
https://github.com/encode/django-rest-framework/pull/6191Third Party Advisory
https://github.com/encode/django-rest-framework/pull/6330Third Party Advisory
https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8Patch, Third Party Advisory
https://github.com/encode/django-rest-framework/pull/6191Third Party Advisory
https://github.com/encode/django-rest-framework/pull/6330Third Party Advisory

Timeline

Published: Jul 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-250469.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2018-250475.4In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and CVE-2018-250488.8The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and CVE-2018-250497.5A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2018-25056.1SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts tha CVE-2018-250506.1A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function A CVE-2018-250516.1A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/cl CVE-2018-250526.1A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function CVE-2018-250536.1A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the f CVE-2018-250545.4A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/sr CVE-2018-250556.1A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an u CVE-2018-250566.1A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/py