CVE-2025-28384

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28388

Versions of OpenC3 COSMOS prior to v6.0.2 are vulnerable to the use of hard-coded credentials for the Service Account. An attacker could leverage these leaked credentials to use the Service Account as a backdoor to the system. Remediation is available by upgrading the openc3 package to version 6....

OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to v6.0.2, which originates from the injection of a specially crafted payload into URL parameters and could lead to the execution of arbitrary web script or HTML...

CVE-2025-28386

A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

OpenC3 COSMOS 安全漏洞

OpenC3 COSMOS is an OpenC3 open source application. A security vulnerability exists in OpenC3 COSMOS versions prior to 6.1.0 that stems from a directory traversal issue in the openc3-api/tables endpoint that could lead to the execution of arbitrary code...

PT-2025-25417 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS version 6.0.0 Description: The issue is related to weak password requirements, allowing attackers to bypass authentication using a brute force attack. Recommendations: For OpenC3 COSMOS version 6.0.0, consider implementing...

CVE-2025-28389: Weak Password Requirements

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

CVE-2025-28382: Improper Limitation of a Pathname to a Restricted Directory

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28380: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

PT-2025-25413

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue allows attackers to execute a directory traversal in the "openc3-api/tables" endpoint. Recommendations For OpenC3 COSMOS version 6.0.0, consider restricting access to the "openc3-api/tables"...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28384

The OpenC3 COSMOS framework (specifically the openc3-cosmos-tool-iframe component) is vulnerable to a Directory Traversal (CWE-22) issue in the /script-api/scripts/ endpoint. The root cause is improper input validation and insufficient sanitization of path parameters, which allows an authenticate...

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

PT-2025-25411

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Recommendations For OpenC3 COSMOS version 6.0.0,...