OpenCATS (< 0.12.0)

OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.