CVE-2023-4451

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
cockpit-hq	cockpit-hq/cockpit	>= unspecified, < 2.6.4
cockpit-hq	cockpit	< 2.6.4

References

https://github.com/cockpit-hq/cockpit/commit/30609466c817e39f9de1871559603e93cd4d0d0cPatch
https://huntr.dev/bounties/4e111c3e-6cf3-4b4c-b3c1-a540bf30f8faExploit, Patch, Third Party Advisory
https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-4451.md
https://github.com/cockpit-hq/cockpit/commit/30609466c817e39f9de1871559603e93cd4d0d0cPatch
https://huntr.dev/bounties/4e111c3e-6cf3-4b4c-b3c1-a540bf30f8faExploit, Patch, Third Party Advisory

Timeline

Published: Aug 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-44527.5A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerab CVE-2023-44535.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.CVE-2023-44545.7Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-44556.5Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-44566.5A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user wi CVE-2023-44577.5Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.CVE-2023-44587.5A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation CVE-2023-44595.5A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxn CVE-2023-44605.4The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a ro CVE-2023-44625.9A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 5 CVE-2023-44637.5A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown cod CVE-2023-44647.2A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 5