CVE-2021-45017: Catfish-CMS Catfish CMS

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.

Affected products

• Catfish-CMS Catfish CMS: up to and including 6.3.0

Published 2021-12-15. Last modified 2026-06-17.