The vulnerability is an authenticated SQL injection in OpenCATS where the home and activity datagrid endpoints accept period, startDate, and endDate parameters without proper validation or escaping. An authenticated user can manipulate these inputs to craft arbitrary SQL, enabling reading of sensitive tables such as users, candidates, contacts, companies, jobs, and activity logs. The weakness falls under uncontrolled input and SQL injection (CWE‑20 and CWE‑89).

Vulnerable versions are all releases of OpenCATS prior to 0.10.0. The affected product is the open‑source application OpenCATS, which is used by staffing agencies and hiring teams.

The CVSS score of 7.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. However, the exploit requires a valid OpenCATS login, so an attacker would need legitimate credentials or an insider. Once authenticated, abuse of the datagrid parameters can lead to full disclosure of the database contents. Because the attack vector is internal, the overall risk for an organization depends on the breadth of user privileges and the sensitivity of the stored data.