CVE-2023-42222: Webcatalog

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Affected products

• Webcatalog Webcatalog: before 49.0 (fixed in 49.0)

Published 2023-09-28. Last modified 2026-06-17.