CO
Product
Cockpit
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 16Low 0
Watch
Add Cockpit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4825 | 9.8 | May 13 | Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo Affected: 0.5.5 |
| CVE-2022-2713 | 9.8 | Aug 8 | Insufficient Session Expiration in cockpit-hq/cockpit Affected: before 2.2.0 |
| CVE-2020-35131 | 9.8 | Jan 8 | Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated… Affected: before 0.6.1 |
| CVE-2020-35848 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function Affected: before 0.11.2 |
| CVE-2020-35847 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function Affected: before 0.11.2 |
| CVE-2020-35846 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function Affected: before 0.11.2 |
| CVE-2018-15540 | 9.8 | Oct 15 | Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access… Affected: All versions, or not specified |
| CVE-2017-14611 | 9.1 | Apr 10 | SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of… Affected: 0.13.0 |
| CVE-2023-4195 | 8.8 | Aug 6 | PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3 Affected: before 2.6.3 |
| CVE-2023-37650 | 8.8 | Jul 20 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands Affected: through 2.5.2 |
| CVE-2023-1313 | 8.8 | Mar 10 | Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1 Affected: through 2.4.0 |
| CVE-2023-0759 | 8.8 | Feb 9 | Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8 Affected: before 2.3.8 |
| CVE-2022-2818 | 8.8 | Aug 15 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2018-15539 | 8.8 | Oct 15 | Agentejo Cockpit lacks an anti-CSRF protection mechanism Affected: All versions, or not specified |
| CVE-2023-37649 | 7.5 | Jul 20 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data Affected: through 2.5.2 |
| CVE-2026-31891 | 6.5 | Mar 18 | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() Affected: before 2.13.5 |
| CVE-2025-7053 | 6.1 | Jul 4 | Cockpit save cross site scripting Affected: through 2.11.3 |
| CVE-2023-41564 | 6.1 | Sep 8 | An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file Affected: 2.6.3 |
| CVE-2023-4451 | 6.1 | Aug 20 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4 Affected: through 2.6.3 |
| CVE-2023-4432 | 6.1 | Aug 19 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4 Affected: through 2.6.3 |
| CVE-2023-4321 | 6.1 | Aug 14 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3 Affected: before 2.4.3 |
| CVE-2021-32857 | 6.1 | Feb 21 | Cockpit is a content management system that allows addition of content management functionality to any site Affected: through 0.12.2 |
| CVE-2020-14408 | 6.1 | Jun 17 | An issue was discovered in Agentejo Cockpit 0.10.2 Affected: 0.10.2 |
| CVE-2018-15538 | 6.1 | Oct 15 | Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities Affected: All versions, or not specified |
| CVE-2023-1160 | 5.5 | Mar 3 | Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0 Affected: through 2.3.9 |
| CVE-2024-2001 | 5.4 | Feb 29 | A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0 Affected: 2.7.0 |
| CVE-2023-4433 | 5.4 | Aug 19 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4 Affected: through 2.6.3 |
| CVE-2023-4395 | 5.4 | Aug 17 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4 Affected: before 2.6.4 |
| CVE-2023-4196 | 5.4 | Aug 6 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3 Affected: before 2.6.3 |
| CVE-2023-0780 | 5.4 | Feb 11 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev Affected: before 2.3.9 |
| CVE-2023-4422 | 4.8 | Aug 18 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3 Affected: before 2.6.3 |
Showing 31