Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

agentejo

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector.

agentejo

Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal.

agentejo

Agentejo Cockpit lacks an anti-CSRF protection mechanism. Thus, an attacker is able to change API tokens, passwords, etc.

agentejo

Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.

agentejo