CVE-2024-21520

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-215217.5All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStrCVE-2024-215227.5All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().CVE-2024-215237.5All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuCVE-2024-215249.1All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling TCVE-2024-215258.3All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcCVE-2024-215267.5All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyCVE-2024-215278.2Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenbergCVE-2024-215285.9All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improCVE-2024-215298.2Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. CVE-2024-21539.8A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown pCVE-2024-215304.5Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functCVE-2024-215315.3All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the pro
CVE-2024-21520: Medium severity, CVSS 6.1 | Vulnix