CVE-2026-54455— OpenCATS: Authenticated SQL injection in activity DataGrid date filters

Quick assessment

Affected

opencats OpenCATS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenCATS 是一款面向人力资源机构和招聘团队的开源求职者跟踪系统与招聘客户关系管理（CRM）工具。在 0.10.0 版本之前，和中的活动数据网格（DataGrid）日期过滤功能存在安全缺陷：其依赖请求中可控的、和参数，但缺乏充分的验证或转义处理。受影响的代码位于和文件中。其中，和的值在未经安全转义的情况下被直接插入到 SQL 字符串比较操作中，而参数则可直接影响生成的 SQL 语句。任何拥有相关 DataGrid 端点访问权限的已认证用户，均可通过篡改请求参数来修改原始查询逻辑，从而访问敏

CVSS 7.6 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

Source: CVE Program / CVE List V5

Vulnerability Description

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`, `startDate` and `endDate` parameters without sufficient validation or escaping. The vulnerable code is in `modules/home/dataGrids.php` and `modules/activity/dataGrids.php`. The `startDate` and `endDate` values are inserted into SQL string comparisons without safe escaping, and `period` can directly influence generated SQL. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders and activity history. A valid OpenCATS login is required; unauthenticated exploitation is not established. This issue is fixed in version 0.10.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opencats	OpenCATS	< 0.10.0	-

II. Public POCs for CVE-2026-54455

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54455

请登录查看更多情报信息。

Other References for CVE-2026-54455 (3)

https://github.com/opencats/OpenCATS/tree/v0.10.0 x_refsource_MISC
https://github.com/opencats/OpenCATS/security/advisories/GHSA-cp24-hjrx-2pm5 x_refsource_CONFIRM
https://github.com/opencats/OpenCATS/commit/814542d9c87770ab967e24e4be6d20a64255b337 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54455

IV. Related Vulnerabilities

Same product: OpenCATS

Same vendor: opencats

Same weakness: CWE-20