Agentejo Cockpit <0.11.2 - NoSQL Injection

披露于 2020/12/30 · 更新于 2025/10/14

CVSS 评分9.8/ 10.0

EPSS 概率93.9%百分位 99.9%

漏洞描述

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 Cockpit 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2026-4631 Cockpit Web Console < 360 - Remote Code Execution Cockpit	严重	—	—	PoCEXP	2026/06/25
CVE-2025-1025 Cockpit < 2.4.1 - Arbitrary File Upload Cockpit	高危	7.5	6.1%	PoCEXP	2025/02/04
CVE-2023-4451RCE Cockpit - Cross-Site Scripting Cockpit	中危	6.1	41.6%	PoCEXP	2023/08/20
CVE-2020-35131RCE Cockpit CMS 0.6.1 - Remote Code Execution Cockpit	严重	9.8	85.3%	PoCEXP	2021/01/08
CVE-2020-35848 Agentejo Cockpit <0.12.0 - NoSQL Injection Cockpit	严重	9.8	88.0%	PoCEXP	2020/12/30
CVE-2020-35846 Agentejo Cockpit < 0.11.2 - NoSQL Injection Cockpit	严重	9.8	93.5%	PoCEXP	2020/12/30