CVE-2023-27293: OpenCATS questionnaire answer stored XSS via unauthenticated submission

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated stored XSS with public exploit references and very high EPSS, though it requires victim interaction and yields limited direct confidentiality and integrity impact.

What it is

OpenCATS fails to neutralize input during web page generation, letting an unauthenticated attacker store malicious JavaScript as a questionnaire answer. That script executes when an authenticated user reviews the candidate's submission, so a single crafted application can run code in a recruiter's browser session.

Impact

An attacker can steal other users' cookies and force authenticated users to perform actions without their knowledge, potentially leading to session hijacking or unauthorized changes in the application.

Attack surface

Reached over the network through the questionnaire submission flow, which requires no authentication; exploitation requires the victim to view the malicious submission, so user interaction is needed. The CVSS vector confirms AV:N, PR:N and UI:R.

Exploitation

No CISA KEV listing, but EPSS is 0.57043 (99th percentile) and both references are tagged Exploit, indicating public exploit detail exists and exploitation is plausible.

What to do

• Apply the vendor fix for OpenCATS once available; check the OpenCATS project for a patched release addressing this XSS.
• If no patch is available, sanitize or encode all questionnaire answer input on output and reject HTML/script content.
• Enforce a strict Content-Security-Policy to limit script execution in the recruiter interface.
• Set session cookies HttpOnly and Secure to reduce cookie theft impact.
• Restrict or review access to candidate submission review pages until the issue is fixed.

Detection

• Search web and application logs for questionnaire submissions containing script tags, event handlers, or javascript: URIs.
• Monitor for anomalous outbound requests or cookie exfiltration patterns from recruiter sessions after reviewing submissions.
• Alert on unexpected account actions or privilege changes performed by authenticated users shortly after viewing candidate submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.