CVE-2021-3945
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3945- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-0054
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
EUVD-2021-0054- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vx6v-xg64-pmr8
Cross-site Scripting in django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Record
GHSA-vx6v-xg64-pmr8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3945- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3945- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vx6v-xg64-pmr8
Cross-site Scripting in django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Record
GHSA-vx6v-xg64-pmr8- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2021-430 No score
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
PYSEC-2021-430- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-helpdeskPyPI |
through 0.3.0 | 0.3.1 |
django-helpdeskPyPI |
before 0.3.1, plus listed versions 0.1.00.1.10.1.100.1.110.1.12 Show 42 moreShow less0.1.130.1.140.1.150.1.160.1.170.1.180.1.20.1.4b0.1.5b0.1.6b0.1.7b0.1.80.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.20.2.200.2.210.2.220.2.230.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.0b10.3.0b20.3.0b30.3.0b40.3.0b5 |
0.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3945 is a high vulnerability (CVSS 8.8) in Django-helpdesk Django-helpdesk/django-helpdesk, published November 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in django-helpdesk 0.3.1.
References
huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4
github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30
nvd.nist.gov/vuln/detail/CVE-2021-3945