Opencats
by Opencats
Source repositories
CVEs (28)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-41560 | Cri | 0.65 | 9.8 | 0.11 | Dec 15, 2021 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. | ||
| CVE-2021-25294 | Cri | 0.65 | 9.8 | 0.11 | Jan 18, 2021 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an… | ||
| CVE-2021-47936 | Cri | 0.64 | 9.8 | 0.01 | May 10, 2026 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and… | ||
| CVE-2022-48011 | Cri | 0.64 | 9.8 | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | ||
| CVE-2022-43019 | Cri | 0.64 | 9.8 | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. | ||
| CVE-2026-49489 | Hig | 0.55 | 8.5 | 0.00 | May 31, 2026 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php… | ||
| CVE-2019-13358 | Hig | 0.54 | 7.5 | 0.24 | Jul 5, 2019 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format. | ||
| CVE-2026-49490 | Hig | 0.53 | 8.1 | 0.00 | May 31, 2026 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable… | ||
| CVE-2026-27760 | Hig | 0.51 | 8.1 | 0.03 | Apr 28, 2026 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the… | ||
| CVE-2022-43023 | Med | 0.42 | 6.5 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | ||
| CVE-2022-43022 | Med | 0.42 | 6.5 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. | ||
| CVE-2022-43021 | Med | 0.42 | 6.5 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. | ||
| CVE-2022-43020 | Med | 0.42 | 6.5 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. | ||
| CVE-2023-27293 | Med | 0.40 | 6.1 | 0.57 | Feb 28, 2023 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal… | ||
| CVE-2022-48012 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. | ||
| CVE-2022-43018 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. | ||
| CVE-2022-43017 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. | ||
| CVE-2022-43016 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. | ||
| CVE-2022-43015 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. | ||
| CVE-2022-43014 | Med | 0.40 | 6.1 | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. |
- risk 0.65cvss 9.8epss 0.11
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
- risk 0.65cvss 9.8epss 0.11
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an…
- risk 0.64cvss 9.8epss 0.01
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and…
- risk 0.64cvss 9.8epss 0.01
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- risk 0.64cvss 9.8epss 0.02
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
- risk 0.55cvss 8.5epss 0.00
OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php…
- risk 0.54cvss 7.5epss 0.24
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
- risk 0.53cvss 8.1epss 0.00
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable…
- risk 0.51cvss 8.1epss 0.03
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the…
- risk 0.42cvss 6.5epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- risk 0.42cvss 6.5epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.
- risk 0.42cvss 6.5epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
- risk 0.42cvss 6.5epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.
- risk 0.40cvss 6.1epss 0.57
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal…
- risk 0.40cvss 6.1epss 0.01
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
- risk 0.40cvss 6.1epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
- risk 0.40cvss 6.1epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
- risk 0.40cvss 6.1epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
- risk 0.40cvss 6.1epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
- risk 0.40cvss 6.1epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
Page 1 of 2