Live › vulnerability › CVE-2026-54455
Go to dashboardOpenCATS, a recruitment CRM, builds SQL from request-supplied date and period parameters in its home and activity DataGrid endpoints without proper escaping. An logged-in user can alter the query to read user accounts, candidate records, contacts, companies, job orders and activity history.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Any self-hosted OpenCATS instance before where users have accounts that can reach the home and activity DataGrid endpoints. Exposure depends on who holds a login, so instances limited to a small trusted team are at lower practical risk but still need the upgrade.
0.10.0No product ranges from the sources yet.
0.10.0.modules/home/dataGrids.php and modules/activity/dataGrids.php exist and contain the date filtering code described in the advisory.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without sufficient validation or escaping. The vulnerable code is in modules/home/dataGrids.php and modules/activity/dataGrids.php. The startDate and endDate values are inserted into SQL string comparisons without safe escaping, and period can directly influence generated SQL. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders and activity history. A valid OpenCATS login is required; unauthenticated exploitation is not established. This issue is fixed in version 0.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-54455")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.