OpenCATS version 0.9.1a and later contains an SQL injection vulnerability in DataGrid filter handling. Authenticated attackers can exploit this vulnerability by injecting SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. The vulnerability allows attackers to bypass column filterable restrictions by manipulating filter requests. This enables execution of arbitrary SQL queries against the database. The vulnerability affects the DataGrid component specifically in the Tags column filtering mechanism.