CVE-2025-28388

Versions of OpenC3 COSMOS prior to v6.0.2 are vulnerable to the use of hard-coded credentials for the Service Account. An attacker could leverage these leaked credentials to use the Service Account as a backdoor to the system. Remediation is available by upgrading the openc3 package to version 6....

OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to v6.0.2, which originates from the injection of a specially crafted payload into URL parameters and could lead to the execution of arbitrary web script or HTML...

CVE-2025-28386

A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to 6.1.0 that stems from a directory traversal issue in the openc3-api/tables endpoint that could lead to the execution of arbitrary code...

PT-2025-25417 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue is related to weak password requirements, allowing attackers to bypass authentication using a brute force attack. Recommendations: For OpenC3 COSMOS version 6.0.0, consider implementing...

CVE-2025-28389: Weak Password Requirements

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

CVE-2025-28382: Improper Limitation of a Pathname to a Restricted Directory

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28380: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

PT-2025-25413

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue allows attackers to execute a directory traversal in the "openc3-api/tables" endpoint. Recommendations For OpenC3 COSMOS version 6.0.0, consider restricting access to the "openc3-api/tables"...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28386

A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...

CVE-2025-28384

The OpenC3 COSMOS framework (specifically the openc3-cosmos-tool-iframe component) is vulnerable to a Directory Traversal (CWE-22) issue in the /script-api/scripts/ endpoint. The root cause is improper input validation and insufficient sanitization of path parameters, which allows an authenticate...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

PT-2025-25411

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations For OpenC3 COSMOS version 6.0.0,...

PT-2025-25416

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue is related to hardcoded credentials for the Service Account. Recommendations For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique, secu...