CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2016-6186
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
Severity
- EPSS
- 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c8c8-9472-w52h | PyPI | django | <1.8.14 | 1.8.14 |
| GHSA-c8c8-9472-w52h | PyPI | django | >=1.9 <1.9.8 | 1.9.8 |
| GHSA-c8c8-9472-w52h | PyPI | django | >=1.10a1 <1.10rc1 | 1.10rc1 |
| PYSEC-2016-2 | PyPI | django | <1.8.14 >=1.9 <1.9.8 >=1.10a0 <1.10rc1 | 1.8.14, 1.9.8, 1.10rc1 |