cve-2023-41564-research

CVE-2023-41564脆弱性概要 CVE-2023-415641はCockpitというCMS= v2.6.3に存在する蓄積型XSSの脆弱性です。 ファイルアップロード時に.shtml拡張子のHTMLファイルをアップロードすると、そのアップロードされたファイルを開いた瞬間にJavaScriptが実行されてしまうというものです。 1: https://nvd.nist.gov/vuln/detail/CVE-2023-41564 攻撃成立の流れ まず初めに、脆弱性の報告者と思われる方が公開しているPoC2を基に攻撃手法を解説していきます。...

CockpitCMS-Arbitrary-File-Upload--XSS---Assets

Cockpit CMS 2.7.0 文件上传 - XSS 作者：Sergio 描述： Cockpit CMS 2.7.0 中的文件上传漏洞允许本地攻击者上传带有隐藏 XSS 的 PDF 文件。 攻击向量： AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L POC： 这是软件版本。 这是注入到 PDF 文件中的 XSS 内容。 登录面板后，我们将进入 General Menu 中的“Assets.”部分，并点击 Upload Asset。 我们上传注入后的 PDF 文件： 在下面的证据中，我们可以看到它已成功上传： 要访问注入后的 PDF，我们按如下所示点击该文件：...

Cockpit CMS 0.6.1 - Remote Code Execution

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. id: CVE-2020-35131 info: name: Cockpit CMS 0.6.1 ...

CVE-2026-39275

CVE-2026-39275 - Cockpit CMS中的存储型XSS导致账户接管 注意：在公开发布前已负责任地向Cockpit CMS维护者披露并已被修复。 | ---|--- CVE ID| CVE-2026-39275 漏洞类型| 存储型跨站脚本 XSS → 账户接管 CWE| CWE-79 受影响版本| Cockpit CMS 的data-csrf属性中。这使得注入的脚本能够读取这两个令牌并在外部重放它们，从而绕过CSRF保护，实现完全的会话劫持和账户接管。 根因 字段 render 的输出被传递到Vue的 v-html 指令，而未进行输出编码。 文件| 行号 ---|---...

CVE-2026-31891

SQL-инъекция в оптимизаторе агрегации MongoLite через toJsonExtractRaw Класс уязвимости : SQL-инъекция CWE-89 Продукт : Cockpit CMS Core Edition Затронутая версия : 2.13.4 и, вероятно, все версии с момента внедрения оптимизатора агрегации Протестированный Docker-образ :...

CVE-2020-35846

Cockpit CMS NoSQLインジェクションによるリモートコード実行 : CVE-2020-35846 説明 Cockpit CMSにはNoSQLの脆弱性がいくつかあり、ユーザー情報をダンプするために使用できます。この情報漏洩を連鎖させることで、ユーザーのパスワードを変更し、サーバー上でリモートコード実行（RCE）につながります。 これらの脆弱性の簡単な説明はこちらで確認できます。 使用方法 root@kitploit: ┌─0z09e─/project/CVE-2020-35846 └──╼ $ python3 exploit.py --help usage: exploit.p...

Linux Distros Unpatched Vulnerability : CVE-2026-39275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...

CVE-2020-35847_CVE-2020-35848

Cockpit CMS NoSQL注入（CVE-2020-35847，CVE-2020-35848） Cockpit CMS 0.11.2之前版本在 /auth/resetpassword 和 /auth/newpassword 接口中存在NoSQL注入漏洞，可导致密码重置令牌泄露，进而实现用户信息枚举及密码重置。 阅读更多 - https://swarm.ptsecurity.com/rce-cockpit-cms/ 此Python脚本用于枚举系统用户并重置密码。 使用方法 root@kitploit: python3 exploit.py -u...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE_2020_35848

🧨 CVE‑2020‑35848 – Laboratório de Injeção NoSQL RCE no Cockpit CMS 0.11.2 O CVE‑2020‑35848 afeta as versões do Agentejo Cockpit CMS anteriores a 0.11.2, introduzindo uma vulnerabilidade crítica de injeção NoSQL no endpoint /auth/newpassword. Essa falha permite que atacantes não autenticados injet...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

EUVD-2026-68098

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

UBUNTU-CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cockpit CMS versions ≤ 2.13.5 are affected by a stored XSS (CWE-79) in the item.php, field-select.js, and tags.js components. Field render() outputs are passed to Vue's v-html directive without output encoding , allowing a low-privilege editor to inject a persistent payload that fires for every a...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...