CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 보통5.4 |
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited. |
| 28/02/2023 |
| CVE-2023-27294 | 보통5.4 | Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could result in stealing sessi | 28/02/2023 |
| CVE-2023-27293 | 보통6.1 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to m | 28/02/2023 |
| CVE-2023-27292 | 보통5.4 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. | 28/02/2023 |
| CVE-2022-48013 | 보통5.4 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields. | 27/01/2023 |
| CVE-2022-48012 | 보통6.1 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. | 27/01/2023 |
| CVE-2022-48011 | 심각9.8 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | 27/01/2023 |
| CVE-2022-43023 | 보통6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | 19/10/2022 |
| CVE-2022-43022 | 보통6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. | 19/10/2022 |
| CVE-2022-43021 | 보통6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. | 19/10/2022 |
| CVE-2022-43020 | 보통6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. | 19/10/2022 |
| CVE-2022-43019 | 심각9.8 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. | 19/10/2022 |
| CVE-2022-43018 | 보통6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. | 19/10/2022 |
| CVE-2022-43017 | 보통6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. | 19/10/2022 |
| CVE-2022-43016 | 보통6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. | 19/10/2022 |
| CVE-2022-43015 | 보통6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. | 19/10/2022 |
| CVE-2022-43014 | 보통6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. | 19/10/2022 |