https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-26847.htmlhttps://patchthecve.com/cve/CVE-2023-26847.htmlWed, 17 Jun 2026 05:43:53 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates.https://patchthecve.com/cve/CVE-2023-26846.htmlhttps://patchthecve.com/cve/CVE-2023-26846.htmlWed, 17 Jun 2026 05:43:52 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the city parameter at opencats/index.php?m=candidates.https://patchthecve.com/cve/CVE-2023-26845.htmlhttps://patchthecve.com/cve/CVE-2023-26845.htmlWed, 17 Jun 2026 05:43:52 +0000MEDIUM 4.3: A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors.https://patchthecve.com/cve/CVE-2023-27295.htmlhttps://patchthecve.com/cve/CVE-2023-27295.htmlWed, 17 Jun 2026 05:44:44 +0000MEDIUM 5.4: Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.https://patchthecve.com/cve/CVE-2023-27294.htmlhttps://patchthecve.com/cve/CVE-2023-27294.htmlWed, 17 Jun 2026 05:44:43 +0000MEDIUM 5.4: Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could resuhttps://patchthecve.com/cve/CVE-2023-27293.htmlhttps://patchthecve.com/cve/CVE-2023-27293.htmlWed, 17 Jun 2026 05:44:43 +0000MEDIUM 6.1: Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies https://patchthecve.com/cve/CVE-2023-27292.htmlhttps://patchthecve.com/cve/CVE-2023-27292.htmlWed, 17 Jun 2026 05:44:43 +0000MEDIUM 5.4: An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.https://patchthecve.com/cve/CVE-2022-48013.htmlhttps://patchthecve.com/cve/CVE-2022-48013.htmlWed, 17 Jun 2026 05:14:34 +0000MEDIUM 5.4: Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields.https://patchthecve.com/cve/CVE-2022-48012.htmlhttps://patchthecve.com/cve/CVE-2022-48012.htmlWed, 17 Jun 2026 05:14:34 +0000MEDIUM 6.1: Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.https://patchthecve.com/cve/CVE-2022-48011.htmlhttps://patchthecve.com/cve/CVE-2022-48011.htmlWed, 17 Jun 2026 05:14:33 +0000CRITICAL 9.8: Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.https://patchthecve.com/cve/CVE-2022-43023.htmlhttps://patchthecve.com/cve/CVE-2022-43023.htmlWed, 17 Jun 2026 05:05:47 +0000MEDIUM 6.5: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.https://patchthecve.com/cve/CVE-2022-43022.htmlhttps://patchthecve.com/cve/CVE-2022-43022.htmlWed, 17 Jun 2026 05:05:46 +0000MEDIUM 6.5: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.https://patchthecve.com/cve/CVE-2022-43021.htmlhttps://patchthecve.com/cve/CVE-2022-43021.htmlWed, 17 Jun 2026 05:05:46 +0000MEDIUM 6.5: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.https://patchthecve.com/cve/CVE-2022-43020.htmlhttps://patchthecve.com/cve/CVE-2022-43020.htmlWed, 17 Jun 2026 05:05:46 +0000MEDIUM 6.5: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.https://patchthecve.com/cve/CVE-2022-43019.htmlhttps://patchthecve.com/cve/CVE-2022-43019.htmlWed, 17 Jun 2026 05:05:46 +0000CRITICAL 9.8: OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.https://patchthecve.com/cve/CVE-2022-43018.htmlhttps://patchthecve.com/cve/CVE-2022-43018.htmlWed, 17 Jun 2026 05:05:46 +0000MEDIUM 6.1: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.https://patchthecve.com/cve/CVE-2022-43017.htmlhttps://patchthecve.com/cve/CVE-2022-43017.htmlWed, 17 Jun 2026 05:05:46 +0000MEDIUM 6.1: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.https://patchthecve.com/cve/CVE-2022-43016.htmlhttps://patchthecve.com/cve/CVE-2022-43016.htmlWed, 17 Jun 2026 05:05:45 +0000MEDIUM 6.1: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.https://patchthecve.com/cve/CVE-2022-43015.htmlhttps://patchthecve.com/cve/CVE-2022-43015.htmlWed, 17 Jun 2026 05:05:45 +0000MEDIUM 6.1: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.https://patchthecve.com/cve/CVE-2022-43014.htmlhttps://patchthecve.com/cve/CVE-2022-43014.htmlWed, 17 Jun 2026 05:05:45 +0000MEDIUM 6.1: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.