CVE-2024-2001: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded...

Arbitrary File Upload

Cockpit CMS is vulnerable to Arbitrary File Upload. The vulnerability is caused by missing validation/sanitization of the request data contained in the POST request body sent to the /assets/upload endpoint while uploading .shtml files. This can lead to arbitrary code execution...

GHSA-38VF-35CG-M73W Cockpit CMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

Cockpit CMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file...

CVE-2023-41564

Cockpit CMS v2.6.3 is vulnerable to arbitrary code execution via the Upload Asset function by uploading a crafted .shtml file to /assets/upload. The root cause is a missing ban of the .shtml extension in the forbiddenExtension list, allowing .shtml uploads that can execute server-side scripts. Th...

Cockpit CMS Cross-Site Request Forgery vulnerability

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

GHSA-9R25-4J77-9WC7 Cockpit CMS vulnerable to incorrect access control

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

GHSA-45G2-R339-PJWF Cockpit CMS Cross-Site Request Forgery vulnerability

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

Cockpit CMS vulnerable to incorrect access control

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

Improper access control

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37649

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...

CVE-2023-37649: Undefined Security Weakness

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data...