{"id":"CVE-2026-115513","kind":"vulnerability","aliases":["CVE-2026-115513"],"related":[],"title":"OpenCATS: stored script injection via record names hijacks admin sessions","description":"OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.","summary":"OpenCATS stores candidate, company, contact, job order and list names without escaping them, then renders them unescaped in the Recent navigation panel. A low-privileged user can plant JavaScript that runs in an administrator's browser, which can steal cookies and take full admin control.","severity":"high","cvss":8.7,"epss":0.00236,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opencats","package","php","self-hosted"],"not_affected_if":["already-on-0.12.0-or-later"],"how_to_check":"Check the installed OpenCATS version; affected versions are those before 0.12.0.","fix":"Upgrade OpenCATS to 0.12.0 or later.\nAfter upgrading, review recently created or renamed records for script tags or event handlers in their names.","status":"open","published_at":"2026-10-22T17:16:59+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:35:15+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:35:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade OpenCATS to 0.12.0 or later.\nAfter upgrading, review recently created or renamed records for script tags or event handlers in their names.","reach":"internet","title":"OpenCATS: stored script injection via record names hijacks admin sessions","impact":"high","summary":"OpenCATS stores candidate, company, contact, job order and list names without escaping them, then renders them unescaped in the Recent navigation panel. A low-privileged user can plant JavaScript that runs in an administrator's browser, which can steal cookies and take full admin control.","category":"package","who_cares":["self-hosted","opencats","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs JavaScript as an admin and takes full control of the application.","analyst_note":"Confirm the exact fixed commit or release notes at the NVD page and whether a workaround exists for versions before 0.12.0.","how_to_check":"Check the installed OpenCATS version; affected versions are those before 0.12.0.\nunknown","needs_analyst":true,"not_affected_if":["already-on-0.12.0-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":3042,"output_tokens":429,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115513':13A,16A '-2026':12A,15A '0.12.0':71C 'admin':9A,67B 'administr':57B,151C,164C 'allow':81C 'arbitrari':140C 'attack':128C 'authent':86C 'browser':59B 'candid':25B,95C 'compani':26B,96C 'contact':27B,97C 'contain':72C 'control':68B,165C 'cooki':63B 'craft':133C 'cross':76C 'cross-sit':75C 'cve':11A,14A 'display':118C 'enabl':156C 'escal':161C 'escap':34B 'everi':121C 'execut':139C 'exploit':130C 'field':103C 'full':66B,163C 'function':127C 'getformat':126C 'hijack':8A 'host':22B 'html/javascript':90C 'includ':149C 'inject':4A,89C 'javascript':52B,141C 'job':28B,98C 'later':109C 'lib/mru.php':124C 'list':31B,101C 'low':47B,84C 'low-privileg':46B,83C 'malici':135C 'mru':115C 'name':7A,32B,137C 'name/title':102C 'navig':43B,116C 'near':120C 'opencat':1A,17B,23B,69C 'order':29B,99C 'packag':18B 'page':122C 'panel':44B,117C 'payload':91C 'php':19B 'plant':51B 'privileg':48B,85C,160C 'recent':42B,114C 'record':6A,136C,155C 'render':37B,110C 'run':54B 'script':3A,78C 'self':21B 'self-host':20B 'session':10A,144C 'session/cookie':157C 'set':93C 'site':77C,150C 'steal':62B 'store':2A,24B,74C,106C 'take':65B 'theft':158C 'unescap':39B,111C 'unsanit':107C 'user':49B,87C,148C 'via':5A,123C 'view':153C 'vulner':79C 'without':33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115513","severity":null,"published_at":"2026-10-22T17:16:59+00:00","modified_at":"2026-10-22T17:16:59+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115513","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115513","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}