Opencats
by Opencats
Source repositories
CVEs (26)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-47936 | Cri | 0.64 | 9.8 | 0.01 | May 10, 2026 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and… | ||
| CVE-2026-49489 | Hig | 0.55 | 8.5 | 0.00 | May 31, 2026 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php… | ||
| CVE-2026-49490 | Hig | 0.53 | 8.1 | 0.00 | May 31, 2026 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable… | ||
| CVE-2026-27760 | Hig | 0.46 | 8.1 | 0.22 | Apr 28, 2026 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the… | ||
| CVE-2019-13358 | 0.05 | — | 0.24 | Jul 5, 2019 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format. | |||
| CVE-2021-25294 | 0.02 | — | 0.11 | Jan 18, 2021 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an… | |||
| CVE-2022-43019 | 0.01 | — | 0.02 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. | |||
| CVE-2021-41560 | 0.01 | — | 0.11 | Dec 15, 2021 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. | |||
| CVE-2023-26846 | 0.00 | — | 0.00 | Apr 11, 2023 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates. | |||
| CVE-2023-26845 | 0.00 | — | 0.00 | Apr 11, 2023 | A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. | |||
| CVE-2023-26847 | 0.00 | — | 0.00 | Apr 11, 2023 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates. | |||
| CVE-2023-27295 | 0.00 | — | 0.00 | Feb 28, 2023 | Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited. | |||
| CVE-2023-27292 | 0.00 | — | 0.01 | Feb 28, 2023 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. | |||
| CVE-2022-48013 | 0.00 | — | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title… | |||
| CVE-2022-48011 | 0.00 | — | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | |||
| CVE-2022-48012 | 0.00 | — | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. | |||
| CVE-2022-43021 | 0.00 | — | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. | |||
| CVE-2022-43018 | 0.00 | — | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. | |||
| CVE-2022-43017 | 0.00 | — | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. | |||
| CVE-2022-43023 | 0.00 | — | 0.01 | Oct 19, 2022 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
- risk 0.64cvss 9.8epss 0.01
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and…
- risk 0.55cvss 8.5epss 0.00
OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/getDataGridPager.php…
- risk 0.53cvss 8.1epss 0.00
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable…
- risk 0.46cvss 8.1epss 0.22
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the…
- CVE-2019-13358Jul 5, 2019risk 0.05cvss —epss 0.24
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
- CVE-2021-25294Jan 18, 2021risk 0.02cvss —epss 0.11
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an…
- CVE-2022-43019Oct 19, 2022risk 0.01cvss —epss 0.02
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
- CVE-2021-41560Dec 15, 2021risk 0.01cvss —epss 0.11
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
- CVE-2023-26846Apr 11, 2023risk 0.00cvss —epss 0.00
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.
- CVE-2023-26845Apr 11, 2023risk 0.00cvss —epss 0.00
A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors.
- CVE-2023-26847Apr 11, 2023risk 0.00cvss —epss 0.00
A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.
- CVE-2023-27295Feb 28, 2023risk 0.00cvss —epss 0.00
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.
- CVE-2023-27292Feb 28, 2023risk 0.00cvss —epss 0.01
An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.
- CVE-2022-48013Jan 27, 2023risk 0.00cvss —epss 0.01
Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title…
- CVE-2022-48011Jan 27, 2023risk 0.00cvss —epss 0.01
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- CVE-2022-48012Jan 27, 2023risk 0.00cvss —epss 0.01
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
- CVE-2022-43021Oct 19, 2022risk 0.00cvss —epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
- CVE-2022-43018Oct 19, 2022risk 0.00cvss —epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
- CVE-2022-43017Oct 19, 2022risk 0.00cvss —epss 0.01
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
- CVE-2022-43023Oct 19, 2022risk 0.00cvss —epss 0.01
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Page 1 of 2