Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

The vulnerability is due to insufficient validation of user-supplied input. By sending a specially crafted packet, a remote unauthenticated attacker can execute arbitrary code on the victim server.

The vulnerability is due to insufficient input validation of the ProjectName parameter contained in the webvact.ocx ActiveX control, a part of the WebAccess Client.

Threat Encyclopedia

1236530

WEB Agentejo Cockpit Auth.php resetpassword function NoSQL injection (CVE-2020-35847)

Critical

2025/06/05

1236528

WEB Agentejo Cockpit Auth.php check function NoSQL injection to RCE (CVE-2020-35846)

Critical

2025/06/05

1139087

ICS Sielco Sistemi Winlog Lite Buffer Overflow Vulnerability -2 (CVE-2012-3815)

Critical

2025/06/05

1139074

ICS Advantech WebAccess SCADA ProjectName Parameter Buffer Overflow -3 (CVE-2014-0991)

Medium

2025/06/04