{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopencatsopencats/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-115513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenCATS (\u003c 0.12.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","xss","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["OpenCATS"],"content_html":"\u003cp\u003eOpenCATS versions prior to 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated low-privileged user can inject malicious HTML or JavaScript payloads into fields such as Candidate, Company, Contact, Job Order, or List names. These payloads are stored unsanitized and rendered unescaped by the lib/MRU.php script within the 'Recent' (MRU) navigation panel. Any user, including a Site Administrator, viewing the navigation panel will execute the injected script.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for session hijacking, cookie theft, and privilege escalation by executing arbitrary JavaScript in the context of other users. Administrative accounts are susceptible to full compromise if they interact with the injected records.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to OpenCATS version 0.12.0 or later immediately to apply the sanitization fixes.\u003c/li\u003e\n\u003cli\u003eAudit application logs for suspicious entries in Candidate, Company, Contact, or Job Order names that contain script tags or HTML attributes.\u003c/li\u003e\n\u003cli\u003eMonitor administrative user sessions for unusual browser activity or rapid privilege changes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T18:15:20Z","date_published":"2026-10-22T18:15:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-opencats-xss/","summary":"OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.","title":"OpenCATS: Stored cross-site scripting (CVE-2026-115513)","url":"https://feed.craftedsignal.io/briefs/2026-10-opencats-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}