It-novum Openitcockpit — known CVE vulnerabilities

Every CVE whose affected-product data names It-novum Openitcockpit, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (17)

• CVE-2019-15490 — CVSS 9.8 (critical): openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
• CVE-2020-10789 — CVSS 9.8 (critical): openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that…
• CVE-2019-15494 — CVSS 9.8 (critical): openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
• CVE-2020-10788 — CVSS 9.1 (critical): openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket…
• CVE-2023-36663 — CVSS 8.8 (high): it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the…
• CVE-2026-24893 — CVSS 8.8 (high): openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version…
• CVE-2019-15491 — CVSS 8.8 (high): openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
• CVE-2026-24892 — CVSS 7.5 (high): openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT…
• CVE-2019-15493 — CVSS 7.5 (high): openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
• CVE-2026-24891 — CVSS 7.5 (high): openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1…
• CVE-2020-10792 — CVSS 7.5 (high): openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname…
• CVE-2020-10791 — CVSS 6.5 (medium): app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to…
• CVE-2019-10227 — CVSS 6.1 (medium): openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
• CVE-2019-15492 — CVSS 6.1 (medium): openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
• CVE-2020-10790 — CVSS 5.4 (medium): openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
• CVE-2023-3520 — CVSS 4.6 (medium): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
• CVE-2023-3218 — CVSS 4.4 (medium): Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.