173 matches found
Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion LFI vulnerability when executed under PHP's built-in CLI server PHPSAPI == 'cli-server' or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATHINFO routes starting with '/:' and...
Cockpit CMS 0.6.1 - Remote Code Execution
Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. id: CVE-2020-35131 info: name: Cockpit CMS 0.6.1 ...
CockpitCMS-Arbitrary-File-Upload--XSS---Assets
Cockpit CMS 2.7.0 Carga de archivos - XSS Autor: Sergio Descripción: Vulnerabilidad de subida de archivos en Cockpit CMS 2.7.0 que permite a un atacante local subir un archivo PDF con XSS oculto. Vectores de ataque: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L PoC: Esta es la versión del software. Este es...
CVE-2026-31891
Inyección SQL en el Optimizador de Agregación de MongoLite mediante toJsonExtractRaw Clase de vulnerabilidad : Inyección SQL CWE-89 Producto : Cockpit CMS Edición Core Versión afectada : 2.13.4 y probablemente todas las versiones desde que se introdujo el Optimizador de Agregación Imagen Docker...
CVE-2026-39275
CVE-2026-39275 - XSS Almacenado que Lleva a la Toma de Control de Cuenta en Cockpit CMS Nota: Divulgado responsablemente y corregido por los mantenedores de Cockpit CMS antes de la publicación...
cve-2023-41564-research
Resumen de la vulnerabilidad CVE-2023-41564 CVE-2023-415641 es una vulnerabilidad de XSS almacenado presente en el CMS Cockpit = v2.6.3. Al cargar un archivo HTML con extensión .shtml durante la subida de archivos, el JavaScript se ejecuta en el momento en que se abre el archivo subido. 1:...
CVE-2020-35846
Inyección NoSQL en Cockpit CMS a Ejecución Remota de Código : CVE-2020-35846 Descripción Cockpit CMS tiene algunas vulnerabilidades NoSQL que pueden usarse para volcar información de usuarios. Estas divulgaciones de información pueden encadenarse para cambiar las contraseñas de los usuarios y...
CVE-2020-35847_CVE-2020-35848
Cockpit CMS Inyección NoSQL CVE-2020-35847, CVE-2020-35848 Cockpit CMS anterior a la versión 0.11.2 es vulnerable a una inyección NoSQL en las rutas /auth/resetpassword y /auth/newpassword que permite la extracción de tokens de restablecimiento de contraseña, lo que posibilita la enumeración de...
CVE_2020_35848
🧨 CVE‑2020‑35848 – Cockpit CMS 0.11.2 Laboratorio de inyección NoSQL RCE CVE‑2020‑35848 afecta a Agentejo Cockpit CMS en versiones anteriores a 0.11.2, introduciendo una vulnerabilidad crítica de inyección NoSQL en el endpoint /auth/newpassword. Este fallo permite a atacantes no autenticados...
Linux Distros Unpatched Vulnerability : CVE-2026-39275
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...
CVE-2026-82449
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
EUVD-2026-68098
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-82449
Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...
CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
PT-2026-83428
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...
CVE-2026-82449: Observable Timing Discrepancy
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...