Opencats Opencats
28 CVEs affecting Opencats Opencats. Latest disclosed: 2026-05-31. Critical: 5, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47936 | Critical | 9.8 | 2026-05-10 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP fi… |
CVE-2022-48011 | Critical | 9.8 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-43019 | Critical | 9.8 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. |
CVE-2021-41560 | Critical | 9.8 | 2021-12-15 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. |
CVE-2021-25294 | Critical | 9.8 | 2021-01-18 | OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unse… |
CVE-2026-49489 | High | 8.5 | 2026-05-31 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to ext… |
CVE-2026-49490 | High | 8.1 | 2026-05-31 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through craf… |
CVE-2026-27760 | High | 8.1 | 2026-04-28 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute ar… |
CVE-2019-13358 | High | 7.5 | 2019-07-05 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a… |
CVE-2022-43023 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-43022 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. |
CVE-2022-43021 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. |
CVE-2022-43020 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. |
CVE-2023-27293 | Medium | 6.1 | 2023-02-28 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire… |
CVE-2022-48012 | Medium | 6.1 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. |
CVE-2022-43018 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. |
CVE-2022-43017 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. |
CVE-2022-43016 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. |
CVE-2022-43015 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. |
CVE-2022-43014 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. |