CVE-2020-35846

CRITICAL NUCLEI

Agentejo Cockpit < 0.11.2 - SQL Injection

Title source: rule

Description

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

Exploits (2)

nomisec WORKING POC 15 stars
by JohnHammond · poc
https://github.com/JohnHammond/CVE-2020-35846
nomisec WORKING POC 6 stars
by 0z09e · poc
https://github.com/0z09e/CVE-2020-35846

Nuclei Templates (1)

Agentejo Cockpit < 0.11.2 - NoSQL Injection
CRITICALby dwisiswant0
Shodan: http.favicon.hash:688609340 || http.html:"cockpit"
FOFA: icon_hash=688609340 || body="cockpit"

References (5)

Scores

CVSS v3 9.8
EPSS 0.9393
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
agentejo/cockpit < 0.11.2
Published Dec 30, 2020
Tracked Since Feb 18, 2026