CVE-2026-54455

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.10.0

Description An issue exists in the activity DataGrid date filtering within the home:CallsDataGrid and activity:ActivityDataGrid endpoints. The application fails to sufficiently validate or escape the request-controlled parameters period, startDate, and endDate in the modules/home/dataGrids.php and modules/activity/dataGrids.php files. Specifically, startDate and endDate are inserted into SQL string comparisons without safe escaping, and the period parameter can directly influence the generated SQL. An authenticated user can exploit this to alter queries and access sensitive database contents, such as user account data, candidate records, contact details, company information, job orders, and activity history.

Recommendations Update to version 0.10.0. Restrict the use of the period, startDate, and endDate parameters in the home:CallsDataGrid and activity:ActivityDataGrid endpoints until the update is applied.