Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-54455OpenCATS: Authenticated SQL injection in activity DataGrid date filters

High 7.6

In plain English

A high-severity improper input validation in OpenCATS from opencats. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`, `startDate` and `endDate` parameters without sufficient validation or escaping. The vulnerable code is in `modules/home/dataGrids.php` and `modules/activity/dataGrids.php`. The `startDate` and `endDate` values are inserted into SQL string comparisons without safe escaping, and `period` can directly influence generated SQL. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders and activity history. A valid OpenCATS login is required; unauthenticated exploitation is not established. This issue is fixed in version 0.10.0.

Affected products (as reported)

Vendor	Product	Versions
opencats	OpenCATS	< 0.10.0

Weakness: CWE-20, CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/opencats/OpenCATS/security/advisories/GHSA-cp24-hjrx-2pm5 x_refsource_CONFIRM
https://github.com/opencats/OpenCATS/commit/814542d9c87770ab967e24e4be6d20a64255b337 x_refsource_MISC
https://github.com/opencats/OpenCATS/tree/v0.10.0 x_refsource_MISC