CVE-2023-4195

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

Vendor	Product	Versions
cockpit-hq	cockpit-hq/cockpit	>= unspecified, < 2.6.3
cockpit-hq	cockpit	< 2.6.3

References

https://github.com/cockpit-hq/cockpit/commit/800c05f1984db291769ffa5fdfb1d3e50968e95bPatch
https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/cockpit-hq/cockpit/commit/800c05f1984db291769ffa5fdfb1d3e50968e95bPatch
https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-419508.8Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.CVE-2023-419514.3Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access CVE-2023-419525.3Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control S CVE-2023-419535.3Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.CVE-2023-419548.6Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects Prof CVE-2023-419558.8Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Ess CVE-2023-419568.8Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.CVE-2023-419579.8Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Memb CVE-2023-41965.4Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.CVE-2023-419603.3The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Andr CVE-2023-419617.8Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potentially enable escalatio CVE-2023-419626.1Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenti