Opencats
Monthly
Authenticated remote code execution in OpenCATS versions prior to 0.10.0 lets an administrator-level user with Settings-module access inject PHP syntax into config.php through the Professional License key field, producing persistent arbitrary code execution as the web server user. The flaw is gated by the PR:H metric in the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High): the attacker must already hold an administrator account with permission to update the Professional License configuration, and config.php must be writable by the web server process for the write-based path to succeed. Successful exploitation gives full confidentiality, integrity and availability impact over candidate, contact, company, job order and user data, and the vendor states unauthenticated exploitation or exploitation by users without Settings access is not established; no public exploit code has been identified at time of analysis and the issue is fixed in v0.10.0.
Authenticated SQL injection in OpenCATS prior to 0.10.0 lets any logged-in user who can reach the home Calls DataGrid (home:CallsDataGrid) or activity DataGrid (activity:ActivityDataGrid) rewrite the date-filter SQL and read data beyond their intended scope, including user accounts, candidate records, contacts, company records, job orders and activity history. The flaw sits in the request-controlled period, startDate and endDate parameters, which are concatenated into SQL date comparisons in modules/home/dataGrids.php and modules/activity/dataGrids.php without validation or escaping; a valid OpenCATS login is required and unauthenticated exploitation is not established. The confidentiality impact dominates (the data exposure is the practical harm), and no public exploit code was identified at time of analysis; the vendor-released patch is OpenCATS 0.10.0.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
SQL injection in OpenCATS 0.9.1a and later allows authenticated attackers to execute arbitrary SQL queries against the backend database by abusing DataGrid filter handling on the Candidates module's Tags column. The flaw bypasses the application's column filterable restrictions, enabling data theft or modification of the recruitment platform's stored candidate records. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract arbitrary database contents by injecting malicious SQL into the sortDirection parameter of ajax/getDataGridPager.php. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), and the issue was disclosed via a GitHub Security Advisory coordinated with VulnCheck. The CVSS 4.0 base score of 8.4 reflects high confidentiality impact with a subsequent-system scope change, though exploitation requires a valid low-privileged account.
Remote code execution in OpenCATS installer allows unauthenticated attackers to inject and execute arbitrary PHP code by manipulating the AJAX endpoint's databaseConnectivity action parameter. The injected code persists in config.php and executes on every page load while the installation wizard remains incomplete. Publicly available exploit code demonstrates breakout from define() string context using quote and statement separator techniques. Patch available via GitHub commit 3002a29, though CVSS AC:H (high complexity) suggests exploitation requires specific timing or environmental conditions during installation phase.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
Missing authorization in OpenCATS before 0.10.0 allows authenticated users holding EDIT or DELETE calendar access to modify or delete other users' calendar events by supplying arbitrary eventID values to CalendarUI::onEditEvent() and onDeleteEvent(), including events intended to be private to their owner. The flaw is an IDOR (CWE-639) that works against default configurations; no public exploit code was identified at time of analysis and there is no CISA KEV listing. It is rated CVSS 4.0 5.3 (Medium), with low integrity impact and no confidentiality or availability impact.
OpenCATS before 0.10.0 allows any authenticated low-privilege user to view EEO demographic reports without holding the canSeeEEOInfo permission, exposing aggregate ethnicity, veteran, gender and disability statistics. Exploitation is a simple direct invocation of the customizeEEOReport and generateEEOReportPreview actions in ReportsUI::handleRequest(); no exploit code beyond the public advisory and GitHub issue is needed, but a valid session is mandatory (PR:L) and no public exploit tooling is confirmed. This is a genuine but low-severity information-disclosure issue, not a high-priority emergency - EPSS and KEV data were not provided and no public exploit was identified at time of analysis.
Missing authorization in the import module of OpenCATS (all versions before 0.10.0) allows any authenticated user holding only READ-level access to invoke the import revert action and mass-delete previously imported candidate, company, and contact records. Exploitation requires valid low-privilege credentials, network access to the web interface, and the existence of a prior import whose importID can be supplied; no administrative rights or user interaction are needed. The vendor has released 0.10.0 with an access-level check in ImportUI::handleRequest(); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated users with only READ-level access in OpenCATS before 0.10.0 can create, rename, delete, and populate saved lists they do not own through the modules/lists/ajax endpoints. The flaw is a missing authorization check (CWE-862) in newList.php, editListName.php, deleteList.php, and addToLists.php, allowing low-privilege accounts to tamper with saved lists site-wide. Impact is limited to integrity because the endpoints do not expose list contents, and no public exploit code was identified in the provided intelligence at time of analysis.
OpenCATS before 0.10.0 permits any authenticated user, including read-only accounts, to invoke ajax/testEmailSettings.php without the required site-administrator authorization and send a fixed test email through the server's configured SMTP relay with an attacker-supplied From address. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (5.3, medium), reflecting mandatory authentication, no confidentiality or availability impact, and limited integrity impact from spoofed outbound mail; the SMTP relay must already be configured for delivery. No public exploit code was identified at time of analysis, and the vendor-released 0.10.0 update contains the authorization fix.
Missing authorization checks in the OpenCATS ajax/deleteActivity.php and ajax/editActivity.php endpoints allow any authenticated user holding READ-level access to edit or delete activity and pipeline history for candidates, contacts and companies by supplying an arbitrary activityID through GET or POST. Only versions before 0.10.0 are affected, and exploitation requires valid low-privilege credentials, so the practical exposure is limited to insiders or attackers who already hold an account. This is an integrity-only issue: no confidential data is disclosed and no denial of service is demonstrated; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
OpenCATS 0.10.0's Career Portal candidate login lacks application-level attempt counters, delays, or rate limiting, allowing remote unauthenticated attackers to repeatedly submit CAPTCHA-checked, low-entropy candidate verification data and potentially disclose candidate information when candidate registration is enabled and publicly reachable. Exploitation is high-complexity (CVSS 4.0 AC:H, PR:N; score 6.3) because each attempt must pass CAPTCHA, and the feature is disabled by default; publicly available exploit code exists, but active exploitation is not confirmed by the supplied KEV data. The issue is a genuine but modest risk rather than an urgent priority, with proxy-layer throttling intended as the practical mitigation.
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote code execution in OpenCATS versions prior to 0.10.0 lets an administrator-level user with Settings-module access inject PHP syntax into config.php through the Professional License key field, producing persistent arbitrary code execution as the web server user. The flaw is gated by the PR:H metric in the CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High): the attacker must already hold an administrator account with permission to update the Professional License configuration, and config.php must be writable by the web server process for the write-based path to succeed. Successful exploitation gives full confidentiality, integrity and availability impact over candidate, contact, company, job order and user data, and the vendor states unauthenticated exploitation or exploitation by users without Settings access is not established; no public exploit code has been identified at time of analysis and the issue is fixed in v0.10.0.
Authenticated SQL injection in OpenCATS prior to 0.10.0 lets any logged-in user who can reach the home Calls DataGrid (home:CallsDataGrid) or activity DataGrid (activity:ActivityDataGrid) rewrite the date-filter SQL and read data beyond their intended scope, including user accounts, candidate records, contacts, company records, job orders and activity history. The flaw sits in the request-controlled period, startDate and endDate parameters, which are concatenated into SQL date comparisons in modules/home/dataGrids.php and modules/activity/dataGrids.php without validation or escaping; a valid OpenCATS login is required and unauthenticated exploitation is not established. The confidentiality impact dominates (the data exposure is the practical harm), and no public exploit code was identified at time of analysis; the vendor-released patch is OpenCATS 0.10.0.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
SQL injection in OpenCATS 0.9.1a and later allows authenticated attackers to execute arbitrary SQL queries against the backend database by abusing DataGrid filter handling on the Candidates module's Tags column. The flaw bypasses the application's column filterable restrictions, enabling data theft or modification of the recruitment platform's stored candidate records. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract arbitrary database contents by injecting malicious SQL into the sortDirection parameter of ajax/getDataGridPager.php. Publicly available exploit code exists (Exploit-DB 52579, Packet Storm), and the issue was disclosed via a GitHub Security Advisory coordinated with VulnCheck. The CVSS 4.0 base score of 8.4 reflects high confidentiality impact with a subsequent-system scope change, though exploitation requires a valid low-privileged account.
Remote code execution in OpenCATS installer allows unauthenticated attackers to inject and execute arbitrary PHP code by manipulating the AJAX endpoint's databaseConnectivity action parameter. The injected code persists in config.php and executes on every page load while the installation wizard remains incomplete. Publicly available exploit code demonstrates breakout from define() string context using quote and statement separator techniques. Patch available via GitHub commit 3002a29, though CVSS AC:H (high complexity) suggests exploitation requires specific timing or environmental conditions during installation phase.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
Missing authorization in OpenCATS before 0.10.0 allows authenticated users holding EDIT or DELETE calendar access to modify or delete other users' calendar events by supplying arbitrary eventID values to CalendarUI::onEditEvent() and onDeleteEvent(), including events intended to be private to their owner. The flaw is an IDOR (CWE-639) that works against default configurations; no public exploit code was identified at time of analysis and there is no CISA KEV listing. It is rated CVSS 4.0 5.3 (Medium), with low integrity impact and no confidentiality or availability impact.
OpenCATS before 0.10.0 allows any authenticated low-privilege user to view EEO demographic reports without holding the canSeeEEOInfo permission, exposing aggregate ethnicity, veteran, gender and disability statistics. Exploitation is a simple direct invocation of the customizeEEOReport and generateEEOReportPreview actions in ReportsUI::handleRequest(); no exploit code beyond the public advisory and GitHub issue is needed, but a valid session is mandatory (PR:L) and no public exploit tooling is confirmed. This is a genuine but low-severity information-disclosure issue, not a high-priority emergency - EPSS and KEV data were not provided and no public exploit was identified at time of analysis.
Missing authorization in the import module of OpenCATS (all versions before 0.10.0) allows any authenticated user holding only READ-level access to invoke the import revert action and mass-delete previously imported candidate, company, and contact records. Exploitation requires valid low-privilege credentials, network access to the web interface, and the existence of a prior import whose importID can be supplied; no administrative rights or user interaction are needed. The vendor has released 0.10.0 with an access-level check in ImportUI::handleRequest(); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated users with only READ-level access in OpenCATS before 0.10.0 can create, rename, delete, and populate saved lists they do not own through the modules/lists/ajax endpoints. The flaw is a missing authorization check (CWE-862) in newList.php, editListName.php, deleteList.php, and addToLists.php, allowing low-privilege accounts to tamper with saved lists site-wide. Impact is limited to integrity because the endpoints do not expose list contents, and no public exploit code was identified in the provided intelligence at time of analysis.
OpenCATS before 0.10.0 permits any authenticated user, including read-only accounts, to invoke ajax/testEmailSettings.php without the required site-administrator authorization and send a fixed test email through the server's configured SMTP relay with an attacker-supplied From address. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (5.3, medium), reflecting mandatory authentication, no confidentiality or availability impact, and limited integrity impact from spoofed outbound mail; the SMTP relay must already be configured for delivery. No public exploit code was identified at time of analysis, and the vendor-released 0.10.0 update contains the authorization fix.
Missing authorization checks in the OpenCATS ajax/deleteActivity.php and ajax/editActivity.php endpoints allow any authenticated user holding READ-level access to edit or delete activity and pipeline history for candidates, contacts and companies by supplying an arbitrary activityID through GET or POST. Only versions before 0.10.0 are affected, and exploitation requires valid low-privilege credentials, so the practical exposure is limited to insiders or attackers who already hold an account. This is an integrity-only issue: no confidential data is disclosed and no denial of service is demonstrated; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
OpenCATS 0.10.0's Career Portal candidate login lacks application-level attempt counters, delays, or rate limiting, allowing remote unauthenticated attackers to repeatedly submit CAPTCHA-checked, low-entropy candidate verification data and potentially disclose candidate information when candidate registration is enabled and publicly reachable. Exploitation is high-complexity (CVSS 4.0 AC:H, PR:N; score 6.3) because each attempt must pass CAPTCHA, and the feature is disabled by default; publicly available exploit code exists, but active exploitation is not confirmed by the supplied KEV data. The issue is a genuine but modest risk rather than an urgent priority, with proxy-layer throttling intended as the practical mitigation.
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.