CVE-2021-37365

6.1 mediumEPSS 0.7%

Medium (6.1) in ctparental project ctparental. EPSS 0.7% chance of exploitation in the next 30 days.

CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_help.php, the 'categories' variable is assigned with the content of the query string param 'cat' without sanitization or encoding, enabling an attacker to inject malicious code into the output webpage.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ctparental_project:ctparental

References

https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a
https://gitlab.com/marsat/CTparental/
https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a
https://gitlab.com/marsat/CTparental/

Check your stack JSON