CVE-2026-113349

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.

OpenCATS prior to 0.10.0, in the Import module (modules/import/ImportUI.php), can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges. This issue is fixed in version 0.10.0.

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments.

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.

OpenCATS before version 0.10.0 contains a SQL injection vulnerability in activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid`, where the `period`, `startDate`, and `endDate` parameters are used without sufficient validation or escaping. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders, and activity history. A valid OpenCATS login is required. This is fixed in version 0.10.0.

In OpenCATS prior to version 0.10.0, the Professional License configuration feature in SettingsUI accepts administrator-controlled license key input that is reconstructed into a PHP define() statement in config.php without safe escaping. Because the application includes config.php, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges.

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability allowing a low-privileged authenticated user to inject HTML/JavaScript payloads via Candidate, Company, Contact, Job Order, or List name/title fields. The value is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel shown on nearly every page via getFormatted() in lib/MRU.php. An attacker can execute arbitrary JavaScript in the session of any other user, including Site Administrators, enabling session/cookie theft and escalation to full administrative control.