Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 27

Export CSV
CVE-2026-121553

Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-100523

Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Siena Siena
CVE-2026-58144

Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-58143

Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-100524

Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Siena
CVE-2026-100521

Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-101093

Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Siena Siena
CVE-2026-100522

Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-93870

Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Siena Siena
CVE-2026-93872

Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-93871

Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-93869

Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex

Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-93873

Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-93868

Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-91939

Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena Siena
CVE-2026-71294

Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti
CVE-2026-55746

Cotonti stored XSS via PFS folder title

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti
CVE-2026-55745

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti
CVE-2026-55744

Cotonti CSRF in PFS allows forced arbitrary file upload

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti
CVE-2026-55742

Cotonti CSRF in admin.rights.php allows privilege escalation

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti