Stored XSS Vulnerability in Django's Admin Interface via Unvalidated URLField (CVE-2026-15920)

7 Aug 2026

djangoxssvulnerabilitysecuritycvecve-2026-15920web

A stored cross-site scripting (XSS) vulnerability was identified in Django's admin interface. The issue arises from an unvalidated URLField display path, allowing malicious JavaScript to be injected and executed. The vulnerability affects Django versions prior to a specific patch.

Read the original article on reddit.com

Stored XSS Vulnerability in Django's Admin Interface via Unvalidated URLField (CVE-2026-15920) | Cyber Hub