{"id":"CVE-2026-27760","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-27760","generatedAt":"2026-10-28T04:46:17.771Z","title":"OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter.","description":"OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.","published":"2026-04-28T15:16:27.000Z","lastModified":"2026-07-14T19:16:53.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":9.2,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-94"],"affected":[],"epss":{"score":0.32975,"percentile":0.9835,"date":"2026-10-27","history":[{"date":"2026-09-24","score":0.03433,"percentile":0.88478},{"date":"2026-10-25","score":0.32975,"percentile":0.98346}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 33.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-10-25T00:00:00.000Z","detail":{"to":0.32975,"from":0.03433,"percentile":0.98346},"summary":"EPSS moved from 3.4% to 33.0% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-24T00:00:00.000Z","detail":{"to":0.03433,"from":0.34629,"percentile":0.88478},"summary":"EPSS moved from 34.6% to 3.4% probability of exploitation in the next thirty days."}],"references":[{"url":"https://chocapikk.com/posts/2026/opencats-installer-rce/","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/pull/706","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-27760","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}