CVE-2020-25626

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

• CWE-20
• CWE-79

• https://bugzilla.redhat.com/show_bug.cgi?id=1878635Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20201016-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5186Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1878635Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20201016-0003/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5186Third Party Advisory

Published

Sep 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25620An issue was discovered in SolarWinds N-Central 12.3.0.670. …7.8
• CVE-2020-25621An issue was discovered in SolarWinds N-Central 12.3.0.670. …8.4
• CVE-2020-25622An issue was discovered in SolarWinds N-Central 12.3.0.670. …8.8
• CVE-2020-25623Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allow…7.5
• CVE-2020-25624hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer ove…5
• CVE-2020-25625hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a …5.3
• CVE-2020-25627The moodlenetprofile user profile field required extra sanit…6.1
• CVE-2020-25628The filter in the tag manager required extra sanitizing to p…6.1
• CVE-2020-25629A vulnerability was found in Moodle where users with "Log in…8.8
• CVE-2020-2563Vulnerability in the Hyperion Financial Close Management pro…4.2
• CVE-2020-25630A vulnerability was found in Moodle where the decompressed s…7.5
• CVE-2020-25631A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8…6.1