This vulnerability affects Cockpit-HQ Cockpit up to version 2.13.5 in the Asset Handler/Aggregate Handler component. It allows remote attackers to manipulate data queries by improperly neutralizing special elements, potentially leading to unintended query behavior. The vulnerability requires no user interaction and can be exploited with low complexity and low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or remediation level has been provided by the vendor, and the exploit is publicly available.

Successful exploitation could allow an attacker to manipulate data queries remotely, which may lead to unauthorized data access or modification depending on the application's handling of query results. The vulnerability does not require user interaction or high privileges, increasing its risk. However, the exact impact on confidentiality, integrity, or availability is rated low to limited based on the CVSS vector, suggesting partial impact on these security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying compensating controls such as restricting network access to the affected service, monitoring for unusual query patterns, and preparing for rapid patch deployment once a fix is released.