CVE-2026-49490CWE-89

OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column

High · published May 31, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-31T12:07Z
EPSS history
Timeline
  • 31 MAY 12:07Z
    OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column
    cvelistv5