Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.
id: CVE-2020-35131
info:
name: Cockpit CMS 0.6.1 - Remote Code Execution
author: DhiyaneshDK
...