Priority CRITICAL 87
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.98165 · Published 2020-12-30 · No fix listed CWE-89
Priority CRITICAL 86
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.93292 · Published 2020-12-30 · No fix listed CWE-89
Priority HIGH 81
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01252 · Published 2022-08-08 · Fixed in 2.2.0 CWE-613
Priority HIGH 81
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.74591 · Published 2020-12-30 · No fix listed CWE-89
Priority HIGH 75
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived fr…
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.0173 · Published 2026-07-02 · No fix listed CWE-22
Priority HIGH 73
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api).
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00479 · Published 2026-07-13 · Fixed CWE-22
Priority HIGH 73
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api).
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00523 · Published 2026-07-13 · Fixed CWE-284
Priority HIGH 73
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00533 · Published 2023-07-20 · Fixed in 2.6.0 CWE-352
Priority HIGH 73
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00987 · Published 2023-03-10 · Fixed in 2.4.1 CWE-434
Priority HIGH 73
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00344 · Published 2023-02-09 · Fixed in 2.3.8 CWE-268
Priority HIGH 73
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.50258 · Published 2021-01-08 · No fix listed CWE-94
Priority HIGH 72
Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00878 · Published 2023-07-20 · Fixed in 2.6.0
Priority HIGH 71
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01053 · Published 2023-08-06 · Fixed in 2.6.3 CWE-98
Priority HIGH 70
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00483 · Published 2026-06-29 · No fix listed CWE-425
Priority MEDIUM 62
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00615 · Published 2023-08-19 · Fixed in 2.6.4 CWE-79
Priority MEDIUM 62
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2023-08-14 · Fixed in 2.4.3 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02478 · Published 2023-08-20 · Fixed in 2.6.4 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0056 · Published 2023-08-19 · Fixed in 2.6.4 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00471 · Published 2023-08-06 · Fixed in 2.6.3 CWE-79
Priority MEDIUM 60
Cockpit is a content management system that allows addition of content management functionality to any site.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00709 · Published 2023-02-20 · No fix listed CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00574 · Published 2023-08-17 · Fixed in 2.6.4 CWE-79
Priority MEDIUM 58
Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00349 · Published 2023-03-03 · Fixed in 2.4.0 CWE-1103
Priority MEDIUM 58
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00373 · Published 2023-02-11 · Fixed in 2.3.9-dev, 2.3.9 CWE-1021
Priority MEDIUM 57
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00233 · Published 2026-04-20 · Fixed in 2.14.0 CWE-20
Priority MEDIUM 57
Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00642 · Published 2023-08-18 · Fixed in 2.6.3 CWE-79
Load more
THREATIST.IORead the docs