CVE-2026-49490 | High | 8.1 | 2026-05-31 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through craf… |
CVE-2026-49489 | High | 8.5 | 2026-05-31 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to ext… |
CVE-2021-47936 | Critical | 9.8 | 2026-05-10 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP fi… |
CVE-2026-27760 | High | 8.1 | 2026-04-28 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute ar… |
CVE-2023-26847 | Medium | 5.4 | 2023-04-11 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2023-26846 | Medium | 5.4 | 2023-04-11 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2023-26845 | Medium | 4.3 | 2023-04-11 | A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. |
CVE-2023-27295 | Medium | 5.4 | 2023-02-28 | Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy p… |
CVE-2023-27294 | Medium | 5.4 | 2023-02-28 | Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript… |
CVE-2023-27293 | Medium | 6.1 | 2023-02-28 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire… |
CVE-2023-27292 | Medium | 5.4 | 2023-02-28 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. |
CVE-2022-48013 | Medium | 5.4 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability… |
CVE-2022-48012 | Medium | 6.1 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. |
CVE-2022-48011 | Critical | 9.8 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-43023 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-43022 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. |
CVE-2022-43021 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. |
CVE-2022-43020 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. |
CVE-2022-43019 | Critical | 9.8 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. |
CVE-2022-43018 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. |
CVE-2022-43017 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. |
CVE-2022-43016 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. |
CVE-2022-43015 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. |
CVE-2022-43014 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. |
CVE-2021-41560 | Critical | 9.8 | 2021-12-15 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. |
CVE-2021-25295 | Medium | 6.1 | 2021-01-18 | OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. |
CVE-2021-25294 | Critical | 9.8 | 2021-01-18 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unse… |
CVE-2019-13358 | High | 7.5 | 2019-07-05 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a… |