CVE-2026-115513High· 8.7▾ TwilightOpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
OpenCATS >= 0.10.0 < 0.12.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112783Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
CVE-2026-112786Medium· 5.4OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
CVE-2026-112784Medium· 4.3OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
CVE-2026-112785Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
CVE-2026-112787Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent