Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111874— OpenCATS Career Portal CareersUI.php processLogin excessive authentication

Quick assessment

Affected
n/a OpenCATS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenCATS 0.10.0 中发现了一个安全漏洞。受影响的是组件“职业门户（Career Portal）”中文件 的 函数。该函数对参数 的处理不当，导致无法有效限制过多的身份验证尝试，从而可能被远程利用。虽然攻击需要较高的复杂度，且利用难度较大，但相关利用代码已经公开并可被使用。 建议安装补丁（提交哈希： ）以修复此问题。项目维护者说明如下： > “候选人现在每次访问职业门户时都需要进行身份验证，并作为验证流程的一部分成功完成 CAPTCHA 挑战。已验证的候选人身份信息现在由服务器端维护，不再依赖此前基

CVSS 3.7 · Low EPSS 0.48% · P40

Possible ATT&CK Techniques 1 AI

T1110 · Brute Force

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a OpenCATS 0.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111874

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenCATS Career Portal CareersUI.php processLogin excessive authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- OpenCATS 0.10.0 cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-111874

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111874

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111874 (2)

Vendor Advisories for CVE-2026-111874 (1)

Proof of Concept for CVE-2026-111874 (1)

Vendor Pages for CVE-2026-111874 (1)

IV. Related Vulnerabilities

Same product: OpenCATS
Same vendor: n/a
Same weakness: CWE-307

V. Comments for CVE-2026-111874

No comments yet

Leave a comment