Live › vulnerability › CVE-2026-115513
Go to dashboardOpenCATS stores candidate, company, contact, job order and list names without escaping them, then renders them unescaped in the Recent navigation panel. A low-privileged user can plant JavaScript that runs in an administrator's browser, which can steal cookies and take full admin control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed OpenCATS version; affected versions are those before 0.12.0.
0.12.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
This page as .md · .json · in your agent: get_signal("CVE-2026-115513")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.