CO
Product
Cockpit
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 16Low 0
Watch
Add Cockpit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4825 | 9.8 | May 13 | Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo Affected: 0.5.5 |
| CVE-2022-2713 | 9.8 | Aug 8 | Insufficient Session Expiration in cockpit-hq/cockpit Affected: before 2.2.0 |
| CVE-2020-35131 | 9.8 | Jan 8 | Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated… Affected: before 0.6.1 |
| CVE-2020-35848 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function Affected: before 0.11.2 |
| CVE-2020-35847 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function Affected: before 0.11.2 |
| CVE-2020-35846 | 9.8 | Dec 30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function Affected: before 0.11.2 |
| CVE-2018-15540 | 9.8 | Oct 15 | Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access… Affected: All versions, or not specified |
| CVE-2017-14611 | 9.1 | Apr 10 | SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of… Affected: 0.13.0 |
| CVE-2023-4195 | 8.8 | Aug 6 | PHP Remote File Inclusion in cockpit-hq/cockpit Affected: before 2.6.3 |
| CVE-2023-37650 | 8.8 | Jul 20 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands Affected: through 2.5.2 |
| CVE-2023-1313 | 8.8 | Mar 10 | Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit Affected: through 2.4.0 |
| CVE-2023-0759 | 8.8 | Feb 9 | Privilege Chaining in cockpit-hq/cockpit Affected: before 2.3.8 |
| CVE-2022-2818 | 8.8 | Aug 15 | Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit Affected: before 2.2.2 |
| CVE-2018-15539 | 8.8 | Oct 15 | Agentejo Cockpit lacks an anti-CSRF protection mechanism Affected: All versions, or not specified |
| CVE-2023-37649 | 7.5 | Jul 20 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data Affected: through 2.5.2 |
| CVE-2026-31891 | 6.5 | Mar 18 | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() Affected: before 2.13.5 |
| CVE-2025-7053 | 6.1 | Jul 4 | Cockpit save cross site scripting Affected: through 2.11.3 |
| CVE-2023-41564 | 6.1 | Sep 8 | An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file Affected: 2.6.3 |
| CVE-2023-4451 | 6.1 | Aug 20 | Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit Affected: through 2.6.3 |
| CVE-2023-4432 | 6.1 | Aug 19 | Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit Affected: through 2.6.3 |
| CVE-2023-4321 | 6.1 | Aug 14 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit Affected: before 2.4.3 |
| CVE-2021-32857 | 6.1 | Feb 20 | Cockpit vulnerable to Cross-site Scripting Affected: through 0.12.2 |
| CVE-2020-14408 | 6.1 | Jun 17 | An issue was discovered in Agentejo Cockpit 0.10.2 Affected: 0.10.2 |
| CVE-2018-15538 | 6.1 | Oct 15 | Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities Affected: All versions, or not specified |
| CVE-2023-1160 | 5.5 | Mar 3 | Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit Affected: through 2.3.9 |
| CVE-2024-2001 | 5.4 | Feb 29 | Cross-Site Scripting vulnerability in Cockpit CMS Affected: 2.7.0 |
| CVE-2023-4433 | 5.4 | Aug 19 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit Affected: through 2.6.3 |
| CVE-2023-4395 | 5.4 | Aug 17 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit Affected: before 2.6.4 |
| CVE-2023-4196 | 5.4 | Aug 6 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit Affected: before 2.6.3 |
| CVE-2023-0780 | 5.4 | Feb 11 | Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit Affected: before 2.3.9 |
| CVE-2023-4422 | 4.8 | Aug 18 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit Affected: before 2.6.3 |
Showing 31