| CVE-2023-26847 | MÉDIO5.4 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates. | 11/04/2023 |
| CVE-2023-26846 | MÉDIO5.4 | A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates. | 11/04/2023 |
| CVE-2023-26845 | MÉDIO4.3 | A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors. | 11/04/2023 |
| CVE-2023-27295 | MÉDIO5.4 | Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited. | 28/02/2023 |
| CVE-2023-27294 | MÉDIO5.4 | Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could result in stealing sessi | 28/02/2023 |
| CVE-2023-27293 | MÉDIO6.1 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to m | 28/02/2023 |
| CVE-2023-27292 | MÉDIO5.4 | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. | 28/02/2023 |
| CVE-2022-48013 | MÉDIO5.4 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields. | 27/01/2023 |
| CVE-2022-48012 | MÉDIO6.1 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. | 27/01/2023 |
| CVE-2022-48011 | CRÍTICO9.8 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | 27/01/2023 |
| CVE-2022-43023 | MÉDIO6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | 19/10/2022 |
| CVE-2022-43022 | MÉDIO6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. | 19/10/2022 |
| CVE-2022-43021 | MÉDIO6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. | 19/10/2022 |
| CVE-2022-43020 | MÉDIO6.5 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. | 19/10/2022 |
| CVE-2022-43019 | CRÍTICO9.8 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. | 19/10/2022 |
| CVE-2022-43018 | MÉDIO6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. | 19/10/2022 |
| CVE-2022-43017 | MÉDIO6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. | 19/10/2022 |
| CVE-2022-43016 | MÉDIO6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. | 19/10/2022 |
| CVE-2022-43015 | MÉDIO6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. | 19/10/2022 |
| CVE-2022-43014 | MÉDIO6.1 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. | 19/10/2022 |