OpenCATS vulnerabilities
CVEs whose affected-version data names the OpenCATS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2026-115513High· 8.7OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field,…
CVE-2026-112783Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary …
CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's…
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access…
CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeE…
CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editList…
CVE-2026-112784Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromA…
CVE-2026-111874Low· 3.7PoCOpenCATS Career Portal CareersUI.php processLogin excessive authentication
A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction o…
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for…