CVE-2026-115513 in OpenCATS
Summary
by MITRE • 10/22/2026
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in OpenCATS versions prior to 0.12.0 represents a critical stored cross-site scripting flaw that undermines the integrity of authenticated sessions within the application. This security defect stems from an insufficient input validation mechanism where user-supplied data is accepted without adequate sanitization before being persisted in the database. Specifically, fields such as Candidate names, Company titles, Contact details, Job Order descriptions, and List identifiers are stored exactly as provided by the submitting user. The system fails to encode or escape these values when they are subsequently retrieved and rendered on client-side interfaces, creating a persistent vector for malicious script injection that affects all users who interact with the compromised records.
From a technical perspective, the exploitation mechanism relies on the application's handling of Most Recently Used (MRU) data displayed in the navigation panel known as MRU.php. The getFormatted() function within this library component retrieves stored record names and outputs them directly into HTML without applying necessary context-specific encoding. When an attacker with low-privileged authenticated access creates or modifies a record, they can embed arbitrary JavaScript payloads within the name or title fields. Because these values are rendered unescaped in the MRU panel which appears on nearly every page of the application, any subsequent user who views this navigation element will have their browser execute the injected scripts automatically. This persistence distinguishes it from reflected XSS attacks, as the malicious code resides on the server and is served to victims upon normal usage rather than requiring a specially crafted link or immediate interaction with the injection point.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and session hijacking. Since the MRU panel is visible across multiple pages, the attack surface is broadened significantly. An attacker can craft payloads designed to exfiltrate session cookies, local storage data, or other sensitive authentication tokens from any user who views the infected record. This includes high-privilege users such as Site Administrators. By stealing these credentials, an adversary can impersonate administrative accounts, bypassing role-based access controls to gain full control over the application environment. This level of compromise allows for further lateral movement within the network, data theft, and potential modification or deletion of critical recruitment database records, thereby disrupting business operations and violating confidentiality requirements.
In terms of industry classification standards, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of the attack where malicious scripts are stored in a data store and later executed by other users corresponds to Stored XSS scenarios. Furthermore, from an offensive security framework perspective such as MITRE ATT&CK, this behavior maps to techniques involving Client-side Injection for Credential Access or Defense Evasion. The ability to execute arbitrary code within the context of trusted websites facilitates unauthorized access and potential persistence mechanisms that are critical in advanced persistent threat campaigns targeting web applications.
Mitigation strategies must focus on implementing robust input validation and output encoding practices immediately upon upgrading past version 0.12.0 where this issue has been addressed. For systems still running older versions, administrators should enforce strict allow-listing of permitted characters for name and title fields to prevent the inclusion of script tags or event handlers. Additionally, applying context-aware HTML entity encoding on all user-supplied data before it is rendered in any web page element is essential to neutralize executable content. Implementing Content Security Policy headers can also provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if a storage flaw persists. Regular security audits and static code analysis focused on data flow between database retrieval and HTML generation will help identify similar vulnerabilities in other parts of the application architecture.