Read the docs
TI-2026-79325 Aliases CVE-2026-115513GHSA-7q62-4fwp-9cr6

OpenCATS Stored XSS via MRU Navigation Panel

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenCATS from 0.10.0 before 0.12.0 contains a stored cross-site scripting flaw (CWE-79) in the names and titles of candidates, companies, contacts, job orders, and lists. Unsanitized values are rendered unescaped in the Recent navigation panel built by lib/MRU.php's getFormatted() function, so a low-privileged authenticated user can run JavaScript in the session of any user who views the record, including Site Administrators. The CVSS 4.0 vector rates the impact on the subsequent system as high confidentiality and integrity, and a user must interact with the page for the attack to succeed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Fix Fixed OpenCATS (opencats): 0.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencatsOpenCATS0.10.0 to before 0.12.00.12.0Patch availableCNA
  • OpenCATS Vendoropencats Affected 0.10.0 to before 0.12.0 Fixed in 0.12.0 Patch available CNA

Remediation

Upgrade OpenCATS to version 0.12.0, which fixes the flaw. The sources list no advisory identifiers for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA OpenCATS (opencats) Fixed in 0.12.0

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115513
  2. 2026-10-22 Alias added: GHSA-7q62-4fwp-9cr6
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Patch 2

Other 1

  • TI-2021-22549 OpenCATS 0.9.4 Remote Code Execution via Resume Upload CVSS 4.0CRITICAL 9.3
  • TI-2026-22120 OpenCATS PHP Code Injection via installer AJAX endpoint CVSS 4.0CRITICAL 9.2
  • TI-2026-36639 OpenCATS - SQL Injection in DataGrid sortDirection Parameter CVSS 4.0HIGH 8.4
  • TI-2023-12031 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 6.1
  • TI-2023-12032 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 5.4
  • TI-2023-12030 Open redirect in OpenCATS CVSS 3.1MEDIUM 5.4
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences