OpenCATS (< 0.12.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/opencats--0.12.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 18:15:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenCATS: Stored cross-site scripting (CVE-2026-115513)https://feed.craftedsignal.io/briefs/2026-10-opencats-xss/Thu, 22 Oct 2026 18:15:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-opencats-xss/OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.OpenCATS versions prior to 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated low-privileged user can inject malicious HTML or JavaScript payloads into fields such as Candidate, Company, Contact, Job Order, or List names. These payloads are stored unsanitized and rendered unescaped by the lib/MRU.php script within the 'Recent' (MRU) navigation panel. Any user, including a Site Administrator, viewing the navigation panel will execute the injected script.

Impact

Successful exploitation allows for session hijacking, cookie theft, and privilege escalation by executing arbitrary JavaScript in the context of other users. Administrative accounts are susceptible to full compromise if they interact with the injected records.

Recommendation

  • Upgrade to OpenCATS version 0.12.0 or later immediately to apply the sanitization fixes.
  • Audit application logs for suspicious entries in Candidate, Company, Contact, or Job Order names that contain script tags or HTML attributes.
  • Monitor administrative user sessions for unusual browser activity or rapid privilege changes.
]]>highadvisoryweb-vulnerabilityxssprivilege-escalation