Vulnerabilities

TI-2026-24443 CVE-2026-31891 · GHSA-7x5c-vfhj-9628

Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

LOW 34

Cockpit is a headless content management system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00413 Published 2026-03-18 Fixed in 2.13.5 CWE-89

TI-2025-06416 CVE-2025-7053 · GHSA-j4rj-fgcq-wmqp

Cockpit save cross site scripting

MEDIUM 56

A vulnerability was found in Cockpit up to 2.11.3.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00363 Published 2025-07-04 Fixed in 2.11.4 CWE-79

TI-2024-04497 CVE-2024-4825 · GHSA-vpj8-xfqc-jcv9

Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo

MEDIUM 49

A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00719 Published 2024-05-13 Fixed in 2.7.0 CWE-434

TI-2024-01861 CVE-2024-2001 · GHSA-q76r-7p4q-mqpw

Cross-Site Scripting vulnerability in Cockpit CMS

LOW 25

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00323 Published 2024-02-29 No fix listed CWE-79

TI-2023-22031 CVE-2023-41564 · GHSA-38vf-35cg-m73w

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3…

LOW 29

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00988 Published 2023-09-08 No fix listed CWE-434

TI-2023-04109 CVE-2023-4451 · GHSA-g3mv-64h3-h482

Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02478 Published 2023-08-20 Fixed in 2.6.4 CWE-79

TI-2023-04091 CVE-2023-4433 · GHSA-ff45-2jp9-69jc

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0056 Published 2023-08-19 Fixed in 2.6.4 CWE-79

TI-2023-04090 CVE-2023-4432 · GHSA-rmgx-3w4r-xcfp

Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

MEDIUM 62

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00615 Published 2023-08-19 Fixed in 2.6.4 CWE-79

TI-2023-04082 CVE-2023-4422 · GHSA-8m65-qq6g-43rr

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

MEDIUM 57

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00642 Published 2023-08-18 Fixed in 2.6.3 CWE-79

TI-2023-04060 CVE-2023-4395 · GHSA-5cv4-48h7-7782

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00574 Published 2023-08-17 Fixed in 2.6.4 CWE-79

TI-2023-03992 CVE-2023-4321 · GHSA-3vf5-xm2p-6mh5

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

MEDIUM 62

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2023-08-14 Fixed in 2.4.3 CWE-79

TI-2023-03885 CVE-2023-4196 · GHSA-w3qm-93vf-5hrw

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-08-06 Fixed in 2.6.3 CWE-79

TI-2023-03884 CVE-2023-4195 · GHSA-xcq3-7pf3-5jvc

PHP Remote File Inclusion in cockpit-hq/cockpit

HIGH 71

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01053 Published 2023-08-06 Fixed in 2.6.3 CWE-98

TI-2023-19207 CVE-2023-37650 · GHSA-45g2-r339-pjwf

A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows…

HIGH 73

A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00533 Published 2023-07-20 Fixed in 2.6.0 CWE-352

TI-2023-19206 CVE-2023-37649 · GHSA-9r25-4j77-9wc7

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows…

HIGH 72

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2023-07-20 Fixed in 2.6.0

TI-2023-01240 CVE-2023-1313 · GHSA-6x8f-x6qw-qwx3

Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit

HIGH 73

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00987 Published 2023-03-10 Fixed in 2.4.1 CWE-434

TI-2023-01098 CVE-2023-1160 · GHSA-p8cq-pv6w-6rwx

Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

MEDIUM 58

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00349 Published 2023-03-03 Fixed in 2.4.0 CWE-1103

TI-2021-12522 CVE-2021-32857 · GHSA-8c8x-phvc-5p9w

Cockpit vulnerable to Cross-site Scripting

MEDIUM 60

Cockpit is a content management system that allows addition of content management functionality to any site.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00709 Published 2023-02-20 No fix listed CWE-79

TI-2023-00740 CVE-2023-0780 · GHSA-gm7m-rqf8-jx4m

Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit

MEDIUM 58

Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00373 Published 2023-02-11 Fixed in 2.3.9-dev, 2.3.9 CWE-1021

TI-2023-00719 CVE-2023-0759 · GHSA-86rf-38v8-9c4x

Privilege Chaining in cockpit-hq/cockpit

HIGH 73

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00344 Published 2023-02-09 Fixed in 2.3.8 CWE-268

TI-2022-02612 CVE-2022-2818 · GHSA-8wj3-cpmr-8whp

Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit

MEDIUM 45

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01673 Published 2022-08-15 Fixed in 2.2.2 CWE-212

TI-2022-02511 CVE-2022-2713 · GHSA-vm6p-35rw-3fxc

Insufficient Session Expiration in cockpit-hq/cockpit

HIGH 81

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01252 Published 2022-08-08 Fixed in 2.2.0 CWE-613

TI-2020-17842 CVE-2020-35131 · GHSA-5qjq-mx2m-jmx9

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote…

HIGH 73

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.50258 Published 2021-01-08 No fix listed CWE-94

TI-2020-18290 CVE-2020-35846 · GHSA-xf6r-h5hg-847v

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

CRITICAL 86

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93292 Published 2020-12-30 No fix listed CWE-89

TI-2020-18292 CVE-2020-35848 · GHSA-vg73-6x83-mx7q

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

HIGH 81

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74591 Published 2020-12-30 No fix listed CWE-89

Vulnerabilities

Filters