CVE-2020-25626

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-256276.1The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in CVE-2020-256286.1The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7 CVE-2020-256298.8A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access CVE-2020-25634.2Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that i CVE-2020-256307.5A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping t CVE-2020-256316.1A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chap CVE-2020-256328.2A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without CVE-2020-256335.3A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentia CVE-2020-256345.4A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitiv CVE-2020-256355.5A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is comple CVE-2020-256367.1A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are CVE-2020-256376.7A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about net