Opencats: >> Opencats >> 0.9.3 Security Vulnerabilities
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
CVSS Score
9.8
EPSS Score
0.462
Published
2021-12-15
OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.
CVSS Score
6.1
EPSS Score
0.008
Published
2021-01-18
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an __destruct magic method in guzzlehttp.
CVSS Score
9.8
EPSS Score
0.277
Published
2021-01-18
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
CVSS Score
7.5
EPSS Score
0.417
Published
2019-07-05