OpenCATS 0.9.1a contains a SQL injection flaw in the DataGrid filter handling for the non-filterable Tags column. Authenticated attackers can craft filter requests that bypass column filterable restrictions, allowing arbitrary SQL queries to run against the underlying database. This vulnerability can be used to read, modify, or delete data stored in the database, compromising confidentiality and integrity. The weakness is a classic example of CWE‑89.

Vendor OpenCATS, product OpenCATS, version 0.9.1a. No other affected versions are listed in the available data.

The CVSS score of 8.6 marks this issue as high severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The exploit requires an authenticated user to access the Candidates DataGrid; the attacker must send a specially crafted filter request that circumvent the column filter rules to execute malicious SQL statements.