PT-2021-16507

Name of the Vulnerable Software and Affected Versions: OpenCATS versions 0.9.5-3 and earlier Description: The issue concerns multiple Cross-site Scripting XSS problems. Cross-site Scripting is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

PT-2021-16506

Name of the Vulnerable Software and Affected Versions: OpenCATS versions 0.9.5-3 and earlier Description: The issue arises from the unsafe deserialization of requests to "index.php?m=activity", leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the...

OpenCats cross-site scripting vulnerabilities

OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A cross-site scripting vulnerability exists in OpenCATS 0.9.5-3 and earlier versions. An...

OpenCATS v0.9.4-3 - Multiple Cross Site Vulnerabilities

Document Title: =============== OpenCATS v0.9.4-3 - Multiple Cross Site Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2232 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID: ====================================...

OpenCats Cross-Site Scripting Vulnerability

OpenCats is an open source recruitment process management system. A cross-site scripting vulnerability exists in the lib/DocumentToText.php file in versions of OpenCats prior to 0.9.4-3. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attack...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

Format string

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

OpenCats prior to 0.9.4-3 contains an XXE in lib/DocumentToText.php that lets remote attackers read files on the underlying OS. Exploitation requires the attacker to upload a docx or odt document, triggering the entity processing. The issue is associated with OpenCats 0.9.4-3 and earlier, with fi...

PT-2019-13290

Name of the Vulnerable Software and Affected Versions OpenCats versions prior to 0.9.4-3 Description The issue allows remote users to read files on the underlying operating system through an XXE vulnerability. This can be achieved by uploading a file in the docx or odt format. Recommendations For...

CVE-2019-13358: Improper Restriction of XML External Entity Reference

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...