CVE-2020-35847

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/162282/Cockpit-CMS-0.11.1-NoSQL-Injection-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/163762/Cockpit-CMS-0.11.1-NoSQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://getcockpit.com/Product, Vendor Advisory
https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466Patch, Vendor Advisory
https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59afPatch, Vendor Advisory
https://github.com/agentejo/cockpit/commit/79fc9631ffa29146e3124ceaf99879b92e1ef24bPatch, Vendor Advisory
http://packetstormsecurity.com/files/162282/Cockpit-CMS-0.11.1-NoSQL-Injection-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/163762/Cockpit-CMS-0.11.1-NoSQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://getcockpit.com/Product, Vendor Advisory
https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466Patch, Vendor Advisory
https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59afPatch, Vendor Advisory
https://github.com/agentejo/cockpit/commit/79fc9631ffa29146e3124ceaf99879b92e1ef24bPatch, Vendor Advisory

Timeline

Published: Dec 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-358489.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.CVE-2020-358497.5An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker t CVE-2020-35853.7A vulnerability in the TLS handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for CVE-2020-358506.5An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor s CVE-2020-358519.8HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remo CVE-2020-358526.1Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no rest CVE-2020-358534.84images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnerability can result in CVE-2020-358544.8Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.CVE-2020-358564.8SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.CVE-2020-358577.5An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack cons CVE-2020-358589.8An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of serv CVE-2020-358599.1An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be