OpenCATS before version 0.12.0 contains a stored cross‑site scripting vulnerability that allows an authenticated user with low privileges to inject arbitrary HTML or JavaScript into the names and titles of several core entities such as Candidate, Company, Contact, Job Order, or List. The malicious payload is persisted without sanitization and later rendered unescaped by the MRU navigation panel on almost every page. This flaw enables an attacker to execute arbitrary code in the browser session of any other user who views the affected record, including site administrators, resulting in session hijacking, cookie theft, and potential full administrative privilege escalation. The weakness is a classic reflected input that is stored and re‑displayed, corresponding to CWE‑79.

The affected product is OpenCATS, as identified by the vendor "opencats" and the product name “OpenCATS”. All releases before 0.12.0 are vulnerable because the vulnerable MRU.php logic is included in those versions. The issue is present on every page that displays the MRU (Most Recently Used) navigation panel, which is built from lib/MRU.php.

The CVSS score of 6.3 classifies the issue as medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread automated exploitation may not yet be seen. However, the attack requires only a low‑privileged authenticated user to create a malicious record and a second user to view it, a pattern that can be easily automated. Attackers could therefore target the system by having an infected user submit a crafted record name and then lure an administrator or other staff member to view the recent items list, leading to privilege escalation.