CVE-2026-115513 Details
Description
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
A stored cross-site scripting vulnerability has been identified in OpenCATS versions 0.10.0 prior to 0.12.0. This vulnerability allows low-privileged authenticated users to inject HTML and JavaScript payloads into various name or title fields, including those for Candidates, Companies, Contacts, Job Orders, and Lists. The injected payloads are stored without proper sanitization and are later rendered unescaped in the 'Recent' (Most Recently Used) navigation panel, which is accessible on nearly every page. The issue arises in the 'lib/MRU.php' file, specifically within the 'getFormatted()' function'.
Users are advised to update to OpenCATS version 0.12.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenCATS | >= 0.10.0, < 0.12.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |