Cotonti CVE-2026-100522

Exploitation requires an unauthenticated attacker to deliver a crafted message.php link with a script payload in the lng parameter AND a victim to open that link in an authenticated or interactive browser session (CVSS UI:A/UI:R). The affected code path is the confirmation dialog in message.php on Cotonti versions through 1.0.0, where the lng value is echoed without htmlspecialchars() escaping. Limiting factors: required user interaction (no drive-by/automatable exploitation), session-scoped impact only (no server-side code execution or data compromise), and the narrow low-footprint product base. A vendor patch is available, so exposure is limited to unpatched instances.

This is a classic reflected cross-site scripting flaw (CWE-79) rated moderate at CVSS 4.0 5.1. The vendor 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/SC:L/SI:L) confirms network-reachable, low-complexity, unauthenticated exploitation, but requires victim interaction (UI:A) - the attacker must lure a user into clicking a crafted link, so it is not a wormable or automatable issue. Impact is confined to the subsequent system (the victim's browser session), rated Low confidentiality/integrity with no availability impact, consistent with reflected XSS rather than server compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. The vulnerability was reported by VulnCheck and a vendor patch (PR #1908) exists, which raises credibility of the finding while lowering urgency. Net: a real but low-priority issue - genuine unauthenticated reflected XSS, but gated by required user interaction, limited to session-level impact, and in a low-footprint product; not a high-real-risk emergency.

An attacker crafts a URL to a Cotonti site's message.php with a JavaScript payload injected into the lng parameter and delivers it via phishing email, forum post, or chat. When a victim clicks the link, the unescaped lng value is reflected into the confirmation dialog and executes in their browser, allowing session cookie theft or actions performed as the victim. No authentication is needed by the attacker, but the victim must open the malicious link; no public POC is indicated.