CVE-2021-37367

CVE-2021-37367 affects CTparental before 4.45.07. The connected sources describe a directory traversal flaw in the admin panel caused by the file bl_categories_help.php, which can be exploited to create a file containing scripts and run arbitrary commands (code execution). Technical details from ...

CVE-2021-37365

CTparental before 4.45.03 is affected by a stored XSS in the admin panel. The vulnerability arises from bl_categires_help.php, where the categories variable is populated with the raw content of the query string parameter cat without sanitization or encoding, allowing attackers to inject script in...

CVE-2021-37366

CVE-2021-37366 affects CTparental prior to version 4.45.03. The vulnerability is a cross-site request forgery (CSRF) in the CTparental admin panel, which—when combined with an XSS vector—could trick an administrator into clicking a link that cancels filtering for all standard users. The available...