OpenCATS vulnerabilities
We track 7 vulnerabilities in OpenCATS products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest OpenCATS vulnerabilities
- 7.6 High severity
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies…
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`,
- 7.2 High severity
OpenCATS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled lic
- 8.7 High severity
OpenCATS: Improper Neutralization of Input During Web Page Generation
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsani
- 9.1 Critical severity
OpenCATS: Unrestricted Upload of File with Dangerous Type
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type a
- 8.1 High severity
OpenCATS: Improper Neutralization of Special Elements used in an SQL Command
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass
- 8.5 High severity
OpenCATS: Improper Neutralization of Special Elements used in an SQL Command
OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to extract database contents. Attackers can inject malicious SQL via the sortDirection parameter in ajax/ge
- 8.1 High severity
OpenCATS: Improper Control of Generation of Code
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers ca