Cotonti vulnerabilities

Products

• Cotonti 21
• Siena 6

Newest

• cotonti Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) CVE-2026-121553 6.3 MediumNovember 3, 2026
• cotonti Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion CVE-2026-101093 5.3 MediumSeptember 28, 2026
• cotonti Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager CVE-2026-100524 5.3 MediumSeptember 26, 2026
• cotonti Cotonti through 1.0.0 Open Redirect via message.php redirect parameter CVE-2026-100523 5.1 MediumSeptember 26, 2026
• cotonti Cotonti through 1.0.0 Reflected XSS via message.php lng parameter CVE-2026-100522 5.1 MediumSeptember 26, 2026
• cotonti Cotonti through 1.0.0 Reflected XSS via search highlight parameter CVE-2026-100521 5.1 MediumSeptember 26, 2026
• cotonti Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin CVE-2026-93873 5.3 MediumSeptember 18, 2026
• cotonti Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter CVE-2026-93872 7.7 HighSeptember 18, 2026
• cotonti Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix CVE-2026-93871 5.1 MediumSeptember 18, 2026
• cotonti Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler CVE-2026-93870 5.3 MediumSeptember 18, 2026
• cotonti Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex CVE-2026-93869 5.3 MediumSeptember 18, 2026
• cotonti Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG CVE-2026-93868 9.2 CriticalSeptember 18, 2026
• cotonti Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter CVE-2026-91939 9.3 CriticalSeptember 15, 2026
• cotonti Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions CVE-2026-71294 Public exploit 7.7 HighAugust 5, 2026
• cotonti Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter CVE-2026-58144 5.1 MediumJuly 9, 2026
• cotonti Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint CVE-2026-58143 8.7 HighJuly 9, 2026
• cotonti Cotonti stored XSS via PFS folder title CVE-2026-55746 7.0 HighJune 18, 2026
• cotonti Cotonti CSRF in PFS folder edit allows unauthorized folder modification CVE-2026-55745 5.3 MediumJune 18, 2026
• cotonti Cotonti CSRF in PFS allows forced arbitrary file upload CVE-2026-55744 8.6 HighJune 18, 2026
• cotonti Cotonti CSRF in admin.rights.php allows privilege escalation CVE-2026-55742 9.4 CriticalJune 18, 2026
• cotonti Cotonti CSRF in admin.config.php allows unauthorized configuration changes CVE-2026-55741 8.7 HighJune 18, 2026
• cotonti siena, cotonti.com cotonti siena +1 more Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting CVE-2021-47808 5.1 MediumJanuary 15, 2026
• cotonti siena A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the... CVE-2025-44115 5.4 MediumJune 2, 2025
• cotonti siena A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9... CVE-2024-24115 5.4 MediumFebruary 8, 2024
• cotonti siena Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. CVE-2022-39839 4.8 MediumSeptember 5, 2022
• cotonti siena Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). CVE-2022-39840 4.8 MediumSeptember 5, 2022
• cotonti siena SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote... CVE-2013-4789 Public exploit 7.5 HighAugust 9, 2013