OpenCATS has 10 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 10. The median CVSS is 7.2 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (5) and CWE-89 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 10 prev 2
Worst active — by depth score
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams50CVE-2026-115513High· 8.7OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel48CVE-2026-54455High· 7.6OpenCATS: Authenticated SQL injection in activity DataGrid date filters42CVE-2026-54453High· 7.2OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)40CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action30
OpenCATS vulnerabilities
CVEs affecting OpenCATS, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-54455High· 7.6OpenCATS: Authenticated SQL injection in activity DataGrid date filters
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses reque…
CVE-2026-54453High· 7.2OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts admin…
CVE-2026-115513High· 8.7OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field,…
CVE-2026-112783Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary …
CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's…
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access…
CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeE…
CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editList…
CVE-2026-112784Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromA…
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for…
CVE-2026-49490High· 8.1OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGri…
CVE-2026-49489High· 8.5PoCOpenCATS - SQL Injection in DataGrid sortDirection Parameter
OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirecti…
CVE-2026-27760High· 8.1PoCOpenCATS PHP Code Injection via installer AJAX endpoint
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action …