CVE-2022-48012

Deeper analysis

Opencats version 0.9.7 contains a reflected cross-site scripting vulnerability in the component located at /opencats/index.php?m=settings&a=ajax_tags_upd. The flaw is tracked as CWE-79 and carries a CVSS 3.1 score of 6.1, reflecting a network-accessible vector that requires no privileges but does depend on user interaction and produces changed scope with limited impacts to confidentiality and integrity.

An unauthenticated remote attacker can exploit the issue by supplying a crafted URL that triggers script execution in a victim's browser when the link is visited. Successful exploitation allows the attacker to perform actions such as stealing session tokens or manipulating page content within the context of the authenticated user's session.

Public proof-of-concept material has been published on GitHub detailing the reflected XSS vector. The associated EPSS score rose from a low baseline to a peak of 0.0505 on 2026-04-20 before receding to the current value of 0.0157, indicating a period of increased exploitation interest after disclosure.