High severity · published May 31, 2026
CVE-2026-49490
OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenCATS · OpenCATS
through 0.9.1a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49490
github.com
https://github.com/opencats/OpenCATS/security/advisories/GHSA-gmpc-j6h7-vw74
www.vulncheck.com
https://www.vulncheck.com/advisories/opencats-sql-injection-in-datagrid-filter-handling-for-tags-column
More from OpenCATS
9.8
CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
9.8
CVE-2022-48011
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function
9.8
CVE-2022-43019
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality
9.8
CVE-2021-41560
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php
9.8
CVE-2021-25294
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution