Cockpit — PoC Archivehttps://poc.intelseclab.com/tags/cockpit/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Red Hat Cockpit `logsJournal.jsx` Shell Injection RCE (CVE-2026-4802)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4802-cockpit-logsjournal-shell-injection/High severity — web · CVE-2026-4802. Status: PoC. Affects: Red Hat Cockpit — the web-based Linux system administration console (cockpit-project.org), specifically pkg/systemd/logsJournal.jsx. **Not** to be confused with the headless "Cockpit CMS".. Tags: cockpit, redhat, shell-injection, command-injection, rce, websocket, systemd, journalctl.webHighcockpitredhatshell-injectioncommand-injectionrcewebsocketsystemdjournalctlCockpit Unauthenticated Remote Code Execution via SSH Argument Injection (CVE-2026-4631)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-4631-cockpit-ssh-rce/Critical severity (CVSS 9.8) — web · CVE-2026-4631 (GHSA-m4gv-x78h-3427). Status: PoC. Affects: Cockpit (Linux web-based server admin console). Tags: cockpit, ssh, command-injection, argument-injection, cwe-78, unauthenticated-rce, proxycommand.webCriticalcockpitsshcommand-injectionargument-injectioncwe-78unauthenticated-rceproxycommand