OpenCATS: Stored cross-site scripting (CVE-2026-115513)

OpenCATS versions prior to 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated low-privileged user can inject malicious HTML or JavaScript payloads into fields such as Candidate, Company, Contact, Job Order, or List names. These payloads are stored unsanitized and rendered unescaped by the lib/MRU.php script within the 'Recent' (MRU) navigation panel. Any user, including a Site Administrator, viewing the navigation panel will execute the injected script.

Impact

Successful exploitation allows for session hijacking, cookie theft, and privilege escalation by executing arbitrary JavaScript in the context of other users. Administrative accounts are susceptible to full compromise if they interact with the injected records.

Recommendation

• Upgrade to OpenCATS version 0.12.0 or later immediately to apply the sanitization fixes.
• Audit application logs for suspicious entries in Candidate, Company, Contact, or Job Order names that contain script tags or HTML attributes.
• Monitor administrative user sessions for unusual browser activity or rapid privilege changes.