CVE-2021-27237: Blackcat-CMS Blackcat CMS

Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days.

The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.

Affected products

• Blackcat-CMS Blackcat CMS: version 1.3.6 only

Published 2021-02-16. Last modified 2026-06-17.