CAT vulnerabilities

1 known vulnerability in CAT from Dianping. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  cat: Reliance on Cookies without Validation and Integrity Checking

  CVE-2026-85181Sep 3, 2026Dianping

  CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin session