CVE-2023-4451

Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

State: Published
Severity: 6.1 Medium
Published: Aug 20, 2023
Updated: Feb 13, 2026
Reserved: Aug 20, 2023

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

Scores

CVSS	Score	Vector	Source
3.0	6.1 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	@huntrdev

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
cockpit-hq/cockpitcockpit-hq	before 2.6.4Affected

References

https://huntr.dev/bounties/4e111c3e-6cf3-4b4c-b3c1-a540bf30f8fa
https://github.com/cockpit-hq/cockpit/commit/30609466c817e39f9de1871559603e93cd4d0d0c
https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-4451.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.