OpenCats 0.9.4-2 -(docx) XML External Entity Injection Vulnerability

Exploit Title: OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection XXE Exploit Author: Jake Ruston Vendor Homepage: https://opencats.org Software Link: https://github.com/opencats/OpenCATS/releases/download/0.9.4-2/opencats-0.9.4-2-full.zip Version: w:document...

OpenCats 0.9.4 XML Injection

Author : Raed Ahsan Platform : OpenCats Version : 0.9.4 Date : 20/09/2021 LinkedIn : https://linkedin.com/in/raed-ahsan INSTRUCTIONS FOR EXPLOITING THE OPENCATS 0.9.4 1 Create a file called "cv.py" 2 Paste the following into the cv.py file: from docx import Document document = Document paragraph ...

OpenCats 0.9.4 XML Injection Vulnerability

Author : Raed Ahsan Platform : OpenCats Version : 0.9.4 LinkedIn : https://linkedin.com/in/raed-ahsan INSTRUCTIONS FOR EXPLOITING THE OPENCATS 0.9.4 1 Create a file called "cv.py" 2 Paste the following into the cv.py file: from docx import Document document = Document paragraph =...

OpenCATS Remote Code Execution (CVE-2021-25294)

A remote code execution vulnerability exists in OpenCATS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

OpenCATS Cross-Site Scripting Vulnerability (CNVD-2021-09918)

OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A cross-site scripting vulnerability exists in OpenCATS 0.9.5-3 and earlier versions. An...

OpenCATS Remote Code Execution Vulnerability

OpenCATS is a free open source candidate/applicant tracking system designed to allow recruiters to manage the hiring process from job posting and candidate application to candidate selection and submission. A remote code execution vulnerability exists in OpenCATS version 0.9.5-3 and earlier. The...

CVE-2021-25295

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

CVE-2021-25295

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

CVE-2021-25294

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...

CVE-2021-25294

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...

Cross site scripting

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

CVE-2021-25294

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...

CVE-2021-25295

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

Remote code execution

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...

CVE-2021-25294

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...

CVE-2021-25294

OpenCATS up to version 0.9.5-3 is affected by CVE-2021-25294 due to unsafe deserialization in lib/DataGrid.php. The vulnerability deserializes index.php?m=activity requests via unserialize on the parameters activity:ActivityDataGrid, enabling a PHP object injection chain that can leverage a __des...

CVE-2021-25295

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

CVE-2021-25295

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) vulnerabilities. Affected product is OpenCATS (v0.9.5-3 and earlier per CNVD/NVD entries). The issue arises in the web application, with XSS described across multiple CVE records and mirrored in Red Hat, CNVD, OSV, and CVE registrie...

CVE-2021-25295: Improper Neutralization of Input During Web Page Generation

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting XSS issues...

CVE-2021-25294: Deserialization of Untrusted Data

OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an destruct magic metho...