Stored Cross-Site Scripting Vulnerability in OpenCATS by OpenCATS

CVE-2026-115513

What is CVE-2026-115513?

OpenCATS versions prior to 0.12.0 are susceptible to a stored cross-site scripting vulnerability that enables low-privileged authenticated users to manipulate data fields related to Candidates, Companies, Contacts, Job Orders, or Lists. Attackers can input malicious HTML or JavaScript into these fields, which are stored without proper sanitization. When these entries are subsequently displayed in the 'Recent' navigation area, the unescaped content can execute arbitrary scripts in the context of any user session, including Site Administrators, leading to potential session and cookie theft, as well as privilege escalation.

References