| CVE-2026-31891 | TRUNG BÌNH6.5 | Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible | 18/03/2026 |
| CVE-2025-7053 | TRUNG BÌNH6.1 | A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address | 04/07/2025 |
| CVE-2024-4825 | NGHIÊM TRỌNG9.8 | A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure. | 14/05/2024 |
| CVE-2024-2001 | TRUNG BÌNH5.4 | A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded. | 29/02/2024 |
| CVE-2023-41564 | TRUNG BÌNH6.1 | An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file. | 08/09/2023 |
| CVE-2023-4451 | TRUNG BÌNH6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 20/08/2023 |
| CVE-2023-4433 | TRUNG BÌNH5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 19/08/2023 |
| CVE-2023-4432 | TRUNG BÌNH6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 19/08/2023 |
| CVE-2023-4422 | TRUNG BÌNH4.8 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 18/08/2023 |
| CVE-2023-4395 | TRUNG BÌNH5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 17/08/2023 |
| CVE-2023-4321 | TRUNG BÌNH6.1 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3. | 14/08/2023 |
| CVE-2023-4196 | TRUNG BÌNH5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 06/08/2023 |
| CVE-2023-4195 | CAO8.8 | PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 06/08/2023 |
| CVE-2023-37650 | CAO8.8 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. | 20/07/2023 |
| CVE-2023-37649 | CAO7.5 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. | 20/07/2023 |
| CVE-2023-1313 | CAO8.8 | Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. | 10/03/2023 |
| CVE-2023-1160 | TRUNG BÌNH5.5 | Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. | 03/03/2023 |
| CVE-2021-32857 | TRUNG BÌNH6.1 | Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue. | 21/02/2023 |
| CVE-2023-0780 | TRUNG BÌNH5.4 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. | 11/02/2023 |
| CVE-2023-0759 | CAO8.8 | Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. | 09/02/2023 |