CVE-2026-49489

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.9.7.5

Description An issue exists in the DataGrid component where authenticated users can extract database contents. Attackers can perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—by injecting malicious SQL via the sortDirection parameter in the 'ajax/getDataGridPager.php' endpoint.

Recommendations Update to a version newer than 0.9.7.4. As a temporary workaround, restrict or avoid using the sortDirection parameter in the 'ajax/getDataGridPager.php' endpoint.