CVE-2020-13596

score

<0.1

cvss

6.1

epss

2.9%

published

2020-06-03

kev added

—

first seen

2026-10-21

Django 2.2 < 2.2.13 and 3.0 < 3.0.7 contain a reflected cross-site scripting caused by improper URL encoding in query parameters generated by ForeignKeyRawIdWidget, letting attackers execute malicious scripts in the context of the victim's browser, exploit requires victim to load malicious URL.