Which versions of OpenCATS are affected by EUVD-2026-33501?

OpenCATS versions through 0.9.7.4 contain a SQL injection vulnerability in the ajax/getDataGridPager.php sortDirection parameter that allows authenticated low-privilege users to extract arbitrary…

Is there a public PoC exploit available for EUVD-2026-33501?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33501. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33501?

24 hours: Inventory all OpenCATS deployments and identify installations running version 0.9.7.4 or earlier; restrict creation of new low-privilege user accounts; enable database transaction and query logging. 7 days: Deploy Web Application Firewall rules to detect and block SQL injection attempts targeting ajax/getDataGridPager.php sortDirection parameter; review database access logs for unauthorized queries; assess what sensitive data is stored in OpenCATS databases. 30 days: Evaluate migration to alternative products or vendor patch when released; audit all OpenCATS database accounts and implement principle of least privilege; segment OpenCATS database from other production systems.

OpenCATS EUVD-2026-33501

Q: What is the CVSS score of EUVD-2026-33501?

EUVD-2026-33501 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-49489 HIGH

SQL Injection (CWE-89)

2026-05-31 VulnCheck

GHSA-5cpr-5mvp-9f62

PHP Information Disclosure SQLi Opencats

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 31, 2026 - 13:30 vuln.today

v3 (cvss_changed)

Analysis Updated

May 31, 2026 - 13:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 31, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

May 31, 2026 - 13:22 NVD

8.5 (HIGH) 8.4 (HIGH)

Analysis Generated

May 31, 2026 - 13:00 vuln.today

DescriptionCVE.org

OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php to perform time-based blind injection attacks and read sensitive data.

AnalysisAI

SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract arbitrary database contents by injecting malicious SQL into the sortDirection parameter of ajax/getDataGridPager.php. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), and the issue was disclosed via a GitHub Security Advisory coordinated with VulnCheck. The CVSS 4.0 base score of 8.4 reflects high confidentiality impact with a subsequent-system scope change, though exploitation requires a valid low-privileged account.

Technical ContextAI

OpenCATS is an open-source PHP-based Applicant Tracking System (CPE cpe:2.3:a:opencats:opencats). The vulnerability sits in the DataGrid component's pager AJAX endpoint (ajax/getDataGridPager.php), where the sortDirection request parameter is concatenated into a SQL ORDER BY clause without proper sanitization or parameterization. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw, and because ORDER BY clauses cannot be bound as standard prepared-statement parameters, developers often fall back to string concatenation - making this class of bug a recurring pattern in PHP web applications. The injection is exploitable as time-based blind, meaning attackers infer data via response-delay oracles (e.g., SLEEP() payloads) rather than direct output.

RemediationAI

No vendor-released patched version is independently confirmed in the supplied data - the GitHub Security Advisory GHSA-8mc8-5gw6-c7w4 should be consulted at https://github.com/opencats/OpenCATS/security/advisories/GHSA-8mc8-5gw6-c7w4 for the upstream fix status and any tagged release beyond 0.9.7.4. Until a confirmed patched build is deployed, restrict the ajax/getDataGridPager.php endpoint at the reverse proxy or WAF layer with an allowlist for sortDirection values of exactly 'ASC' or 'DESC' (any other value should be dropped), which neutralizes the injection vector with minimal functional impact since these are the only legitimate values. Additionally, tighten account provisioning to remove dormant or shared low-privilege accounts, and place the OpenCATS instance behind authenticated VPN or IP allowlisting to shrink the attacker population; the trade-off is reduced accessibility for remote recruiters. Monitor database query logs for anomalous SLEEP(), BENCHMARK(), or unusually long-running ORDER BY queries originating from the DataGrid endpoint as a detection-side control.