CVE-2026-115513 OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115513?
CVE-2026-115513 is a medium-severity vulnerability in OpenCATS, published on 22 Oct 2026.
Official description
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
Weakness: CWE-79
Which versions are affected by CVE-2026-115513?
How do I fix CVE-2026-115513?
No fix has been published for CVE-2026-115513 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115513 being exploited?
There is no known exploitation of CVE-2026-115513 in the wild and no public exploit code.
Sources
Also known as GHSA-7q62-4fwp-9cr6.