Cotonti
Monthly
PHP object injection in Cotonti 1.0.0 allows authenticated users with comment-write permissions to pass attacker-controlled base64-encoded data through the cb (comeback) parameter of the comments plugin EditAction, which is then unserialized without an allowed_classes restriction. This can lead to arbitrary PHP object instantiation and, only if a viable POP gadget chain exists among loaded classes, escalation to file write or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; the vendor has published a fix in PR #1897, and the vendor CVSS 4.0 score is 7.7, while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated attackers can reset the password of any Cotonti account, including administrator accounts, because password-recovery validation tokens in Cotonti through 1.0.0 are derived from md5(microtime()) rather than a cryptographically secure random source, leaving roughly one million predictable candidate values per second. Exploitation requires the attacker to trigger the recovery flow for a target account, read the server's Date header to bootstrap the microtime() timing window, then precompute and probe candidate tokens against the passrecover endpoint before the seed drifts - a timing-constrained but fully unauthenticated attack (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H; CVSS 4.0 base 9.2). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; any endpoint rate-limiting or short token lifetime further constrains the probing step, so this is a genuine high-priority flaw rather than a CVSS-inflation case.
PHP object injection in the Cotonti 1.0.0 Comments plugin allows unauthenticated, network-reachable attackers to instantiate arbitrary PHP classes with attacker-controlled properties by feeding a crafted base64-encoded payload through the `ci` GET parameter, which is passed to unserialize() without an allowed_classes restriction. Any default Cotonti 1.0.0 deployment with the Comments plugin enabled and its widget rendering is exposed; no credentials or user interaction are required, and successful gadget-chain abuse can lead to database manipulation or remote code execution. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor has published an upstream fix via pull request #1889 that hardens the deserialization call.
PHP Object Injection in Cotonti CMS's Comments plugin grants any authenticated member a deserialization primitive reachable via two default-accessible sinks, with a working POP chain already demonstrated by the researcher. The `ci` POST parameter in CreateAction.php and the `cb` parameter in EditAction.php are both base64-decoded and passed to `unserialize()` without an `allowed_classes` restriction, allowing instantiation of any class loaded in the PHP runtime. A proof-of-concept using Cotonti's built-in MySQL_cache class was confirmed to trigger attacker-controlled SQL INSERT operations via `__destruct()->flush()`; further impact including RCE is contingent on additional gadget chains available in a given installation. No public exploit code has been released and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting in Cotonti 1.0.0 (master branch, commit f43f1fc3) lets an authenticated user inject HTML/JavaScript into Personal File Storage (PFS) folder titles, which then execute in any viewer's browser when the folder listing is rendered. The flaw stems from the 'TXT' import filter not encoding HTML combined with unescaped template output, and no public exploit identified at time of analysis. Discovered by TuranSec; impact extends to other users browsing public folders, enabling session theft or account actions in their context.
Cross-Site Request Forgery in the Personal File Storage (PFS) module of Cotonti 1.0.0 (commit f43f1fc3) allows remote attackers to upload arbitrary files into an authenticated victim's storage by luring them to a malicious page. The 'a=upload' action in modules/pfs/inc/pfs.main.php omits the cot_check_xg() anti-CSRF token check that sibling actions like 'delete' enforce. No public exploit identified at time of analysis, though the root cause is documented in the public source code reference.
Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) lets a remote attacker escalate privileges to administrator by tricking a logged-in admin into loading an attacker-controlled page that submits a forged rights-update request to system/admin/admin.rights.php. Because Cotonti administrators can edit templates and configuration, the resulting account can be pivoted to remote code execution on the host. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) administration configuration handler allows a remote attacker to coerce an authenticated administrator's browser into silently modifying arbitrary core, module, or plugin configuration options. The flaw in system/admin/admin.config.php stems from the 'a=update' action invoking cot_config_update_options() without the cot_check_xg() anti-CSRF token check used elsewhere in the admin panel. No public exploit identified at time of analysis, though the root cause is well-documented at the source line level by the reporter (TuranSec).
Predictable email-ownership verification tokens in Cotonti through 1.0.0 let unauthenticated remote attackers activate accounts or confirm email addresses they do not control. Because tokens are generated as md5(microtime()), an attacker who reads the server's HTTP Date header can pin the whole-second portion of the timestamp, brute-force the sub-second component offline (roughly one million candidates per targeted second), and replay any matching 32-character token to the users.register.php validate handler. Severity is rated CVSS 4.0 6.3 with AC:H reflecting the microsecond-guessing requirement that limits reliability and scale; no public exploit identified at time of analysis, and priority is this_month per vulnerability intelligence scoring.
Cross-site request forgery in Cotonti CMS through 1.0.0 lets an attacker who lures an authenticated administrator to a malicious page delete custom user groups and their associated permissions without any token verification. The vulnerable logic sits in system/admin/admin.users.php (around lines 136-140), where the user-group deletion action executes without the framework's anti-CSRF (xg) check, so a forged request simply rides the administrator's live session. From the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) the attacker needs no credentials of their own but cannot succeed without an administrator's valid session and interaction, which keeps this a low-to-moderate priority issue; no public exploit code has been identified at time of analysis, there is no evidence of confirmed active exploitation, and the vendor has published fix code.
Cross-site request forgery in the Cotonti CMS extensions manager through 1.0.0 allows an attacker to make a logged-in administrator's browser silently install, update, pause, or unpause extensions, because system/admin/admin.extensions.php performs these state-changing actions without validating an anti-CSRF token. The attacker is unauthenticated (CVSS 4.0 vector PR:N), but exploitation succeeds only if the victim holds a valid Cotonti admin session and loads attacker-controlled content such as a crafted link or embedded image, making user interaction (UI:P) the gating factor; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV entry). Impact is limited to integrity and availability of the extension set with no confidentiality exposure and no code execution from this issue alone (CVSS 4.0 5.3; independent assessment CVSS 3.1 5.3, C:N/I:L/A:L) - a real but modest-priority issue.
Open redirect in Cotonti CMS through 1.0.0 lets unauthenticated attackers turn the message.php handler into a phishing trampoline: the `redirect` parameter is base64-decoded and echoed into a meta-refresh tag without any domain validation, so a crafted link sends victims to an arbitrary external site under the trusted Cotonti domain. Any default installation up to and including 1.0.0 is affected and no authentication is required (PR:N in the vector), but exploitation depends on victim interaction (UI:A) - the target must open the crafted message.php URL. No public exploit code was identified at time of analysis, and there is no CISA KEV entry; the impact is scoped to redirect/phishing abuse against users rather than compromise of the Cotonti server itself.
Reflected cross-site scripting in the Cotonti CMS through 1.0.0 allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link whose lng parameter is echoed without escaping into the message.php confirmation dialog. Exploitation requires victim interaction (remote, unauthenticated, UI:A per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N vector), and the impact is session-scoped - session/cookie theft, phishing-style content injection, or actions performed as the victim - with no server-side code execution or data compromise. An upstream fix has been published (GitHub PR 1908) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Cotonti CMS search plugin (all versions through 1.0.0) lets remote, unauthenticated attackers inject JavaScript through the 'highlight' parameter of a crafted search URL, with the payload executing in the browser of any visitor who opens the link. The attack is not automatic: it requires the victim to click a malicious link (UI:A), and it is most dangerous when the tricked visitor is a logged-in administrator, because the injected script then runs with admin session privileges and can perform administrative actions. Patch data indicates an upstream vendor fix is available via GitHub pull request #1908; no public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited.
Cross-site request forgery in the Cotonti CMS contact plugin (through version 1.0.0) lets an attacker auto-submit the contact form from an attacker-controlled page, sending forged messages into the administrator inbox that appear to originate from a logged-in victim (CWE-352, CVSS 4.0 base 5.3 / assessed CVSS 3.1 5.3). The submission handler never validates an anti-CSRF token, so any authenticated user who visits a malicious page while their session is active can be silently impersonated. Exploitation requires victim interaction and an enabled contact plugin, and the impact is limited to message forgery and inbox spam - no data disclosure or system compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Cotonti CMS (often branded simply as Cotonti) through version 1.0.0 stores page bodies beginning with the `redir:` prefix as redirects without validating the destination, letting an authenticated user who can create or edit pages point visitors from a trusted Cotonti-hosted page to an arbitrary external site for phishing. Exploitation requires a valid account holding page creation or edit permissions (CVSS vector PR:L) and depends on a victim opening the crafted page (UI:P), with impact limited to redirecting visitors - no server-side code execution or data compromise is possible. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis; EPSS and KEV data were not provided. The vendor/upstream fix is PR #1901, which adds a `cot_url_check` guard rejecting external `http`/`ftp` destinations.
Cotonti through 1.0.0 allows unauthenticated remote attackers to forge rating submissions on behalf of an authenticated user when the ratings plugin is enabled. The attacker must lure a logged-in user with rating privileges to a malicious page that auto-submits a POST to the ratings AJAX handler, modifying stored rating data without the victim’s intent. A vendor patch is indicated and an upstream fix exists in GitHub PR 1900, but no public exploit was identified at time of analysis.
Open redirect in Cotonti through 1.0.0 lets remote, unauthenticated attackers bounce victims to arbitrary attacker-controlled sites by supplying a hostname that merely begins with the legitimate site domain, defeating the cot_url_check() validation used by the ratings plugin and other redirect callers. Exploitation is constrained by required victim interaction - a user must follow a crafted link through a reachable redirect caller such as plugins/ratings/ratings.ajax.php - and yields only redirection to an attacker host, not code execution or data compromise, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N vector (CVSS 4.0 base 5.3). This is a low-severity, internally consistent issue with no public exploit identified at time of analysis; there is no evidence of active exploitation or KEV listing.
Cross-site request forgery in Cotonti 1.0.0's Personal File Storage module allows remote attackers to hijack authenticated user sessions to silently modify folder metadata. The folder update action ('a=update') in modules/pfs/inc/pfs.editfolder.php processes state-changing requests without invoking Cotonti's built-in anti-CSRF token validation function cot_check_xg(), enabling an attacker to force a logged-in user to unknowingly expose private folders or alter their descriptions. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV, but the specific vulnerable code commit is publicly identified by the reporter TuranSec.
Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page. [CVSS 5.4 MEDIUM]
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
PHP object injection in Cotonti 1.0.0 allows authenticated users with comment-write permissions to pass attacker-controlled base64-encoded data through the cb (comeback) parameter of the comments plugin EditAction, which is then unserialized without an allowed_classes restriction. This can lead to arbitrary PHP object instantiation and, only if a viable POP gadget chain exists among loaded classes, escalation to file write or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; the vendor has published a fix in PR #1897, and the vendor CVSS 4.0 score is 7.7, while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Unauthenticated attackers can reset the password of any Cotonti account, including administrator accounts, because password-recovery validation tokens in Cotonti through 1.0.0 are derived from md5(microtime()) rather than a cryptographically secure random source, leaving roughly one million predictable candidate values per second. Exploitation requires the attacker to trigger the recovery flow for a target account, read the server's Date header to bootstrap the microtime() timing window, then precompute and probe candidate tokens against the passrecover endpoint before the seed drifts - a timing-constrained but fully unauthenticated attack (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H; CVSS 4.0 base 9.2). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; any endpoint rate-limiting or short token lifetime further constrains the probing step, so this is a genuine high-priority flaw rather than a CVSS-inflation case.
PHP object injection in the Cotonti 1.0.0 Comments plugin allows unauthenticated, network-reachable attackers to instantiate arbitrary PHP classes with attacker-controlled properties by feeding a crafted base64-encoded payload through the `ci` GET parameter, which is passed to unserialize() without an allowed_classes restriction. Any default Cotonti 1.0.0 deployment with the Comments plugin enabled and its widget rendering is exposed; no credentials or user interaction are required, and successful gadget-chain abuse can lead to database manipulation or remote code execution. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor has published an upstream fix via pull request #1889 that hardens the deserialization call.
PHP Object Injection in Cotonti CMS's Comments plugin grants any authenticated member a deserialization primitive reachable via two default-accessible sinks, with a working POP chain already demonstrated by the researcher. The `ci` POST parameter in CreateAction.php and the `cb` parameter in EditAction.php are both base64-decoded and passed to `unserialize()` without an `allowed_classes` restriction, allowing instantiation of any class loaded in the PHP runtime. A proof-of-concept using Cotonti's built-in MySQL_cache class was confirmed to trigger attacker-controlled SQL INSERT operations via `__destruct()->flush()`; further impact including RCE is contingent on additional gadget chains available in a given installation. No public exploit code has been released and no CISA KEV listing exists at time of analysis.
Stored cross-site scripting in Cotonti 1.0.0 (master branch, commit f43f1fc3) lets an authenticated user inject HTML/JavaScript into Personal File Storage (PFS) folder titles, which then execute in any viewer's browser when the folder listing is rendered. The flaw stems from the 'TXT' import filter not encoding HTML combined with unescaped template output, and no public exploit identified at time of analysis. Discovered by TuranSec; impact extends to other users browsing public folders, enabling session theft or account actions in their context.
Cross-Site Request Forgery in the Personal File Storage (PFS) module of Cotonti 1.0.0 (commit f43f1fc3) allows remote attackers to upload arbitrary files into an authenticated victim's storage by luring them to a malicious page. The 'a=upload' action in modules/pfs/inc/pfs.main.php omits the cot_check_xg() anti-CSRF token check that sibling actions like 'delete' enforce. No public exploit identified at time of analysis, though the root cause is documented in the public source code reference.
Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) lets a remote attacker escalate privileges to administrator by tricking a logged-in admin into loading an attacker-controlled page that submits a forged rights-update request to system/admin/admin.rights.php. Because Cotonti administrators can edit templates and configuration, the resulting account can be pivoted to remote code execution on the host. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) administration configuration handler allows a remote attacker to coerce an authenticated administrator's browser into silently modifying arbitrary core, module, or plugin configuration options. The flaw in system/admin/admin.config.php stems from the 'a=update' action invoking cot_config_update_options() without the cot_check_xg() anti-CSRF token check used elsewhere in the admin panel. No public exploit identified at time of analysis, though the root cause is well-documented at the source line level by the reporter (TuranSec).
Predictable email-ownership verification tokens in Cotonti through 1.0.0 let unauthenticated remote attackers activate accounts or confirm email addresses they do not control. Because tokens are generated as md5(microtime()), an attacker who reads the server's HTTP Date header can pin the whole-second portion of the timestamp, brute-force the sub-second component offline (roughly one million candidates per targeted second), and replay any matching 32-character token to the users.register.php validate handler. Severity is rated CVSS 4.0 6.3 with AC:H reflecting the microsecond-guessing requirement that limits reliability and scale; no public exploit identified at time of analysis, and priority is this_month per vulnerability intelligence scoring.
Cross-site request forgery in Cotonti CMS through 1.0.0 lets an attacker who lures an authenticated administrator to a malicious page delete custom user groups and their associated permissions without any token verification. The vulnerable logic sits in system/admin/admin.users.php (around lines 136-140), where the user-group deletion action executes without the framework's anti-CSRF (xg) check, so a forged request simply rides the administrator's live session. From the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) the attacker needs no credentials of their own but cannot succeed without an administrator's valid session and interaction, which keeps this a low-to-moderate priority issue; no public exploit code has been identified at time of analysis, there is no evidence of confirmed active exploitation, and the vendor has published fix code.
Cross-site request forgery in the Cotonti CMS extensions manager through 1.0.0 allows an attacker to make a logged-in administrator's browser silently install, update, pause, or unpause extensions, because system/admin/admin.extensions.php performs these state-changing actions without validating an anti-CSRF token. The attacker is unauthenticated (CVSS 4.0 vector PR:N), but exploitation succeeds only if the victim holds a valid Cotonti admin session and loads attacker-controlled content such as a crafted link or embedded image, making user interaction (UI:P) the gating factor; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV entry). Impact is limited to integrity and availability of the extension set with no confidentiality exposure and no code execution from this issue alone (CVSS 4.0 5.3; independent assessment CVSS 3.1 5.3, C:N/I:L/A:L) - a real but modest-priority issue.
Open redirect in Cotonti CMS through 1.0.0 lets unauthenticated attackers turn the message.php handler into a phishing trampoline: the `redirect` parameter is base64-decoded and echoed into a meta-refresh tag without any domain validation, so a crafted link sends victims to an arbitrary external site under the trusted Cotonti domain. Any default installation up to and including 1.0.0 is affected and no authentication is required (PR:N in the vector), but exploitation depends on victim interaction (UI:A) - the target must open the crafted message.php URL. No public exploit code was identified at time of analysis, and there is no CISA KEV entry; the impact is scoped to redirect/phishing abuse against users rather than compromise of the Cotonti server itself.
Reflected cross-site scripting in the Cotonti CMS through 1.0.0 allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link whose lng parameter is echoed without escaping into the message.php confirmation dialog. Exploitation requires victim interaction (remote, unauthenticated, UI:A per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N vector), and the impact is session-scoped - session/cookie theft, phishing-style content injection, or actions performed as the victim - with no server-side code execution or data compromise. An upstream fix has been published (GitHub PR 1908) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Cotonti CMS search plugin (all versions through 1.0.0) lets remote, unauthenticated attackers inject JavaScript through the 'highlight' parameter of a crafted search URL, with the payload executing in the browser of any visitor who opens the link. The attack is not automatic: it requires the victim to click a malicious link (UI:A), and it is most dangerous when the tricked visitor is a logged-in administrator, because the injected script then runs with admin session privileges and can perform administrative actions. Patch data indicates an upstream vendor fix is available via GitHub pull request #1908; no public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited.
Cross-site request forgery in the Cotonti CMS contact plugin (through version 1.0.0) lets an attacker auto-submit the contact form from an attacker-controlled page, sending forged messages into the administrator inbox that appear to originate from a logged-in victim (CWE-352, CVSS 4.0 base 5.3 / assessed CVSS 3.1 5.3). The submission handler never validates an anti-CSRF token, so any authenticated user who visits a malicious page while their session is active can be silently impersonated. Exploitation requires victim interaction and an enabled contact plugin, and the impact is limited to message forgery and inbox spam - no data disclosure or system compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Cotonti CMS (often branded simply as Cotonti) through version 1.0.0 stores page bodies beginning with the `redir:` prefix as redirects without validating the destination, letting an authenticated user who can create or edit pages point visitors from a trusted Cotonti-hosted page to an arbitrary external site for phishing. Exploitation requires a valid account holding page creation or edit permissions (CVSS vector PR:L) and depends on a victim opening the crafted page (UI:P), with impact limited to redirecting visitors - no server-side code execution or data compromise is possible. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis; EPSS and KEV data were not provided. The vendor/upstream fix is PR #1901, which adds a `cot_url_check` guard rejecting external `http`/`ftp` destinations.
Cotonti through 1.0.0 allows unauthenticated remote attackers to forge rating submissions on behalf of an authenticated user when the ratings plugin is enabled. The attacker must lure a logged-in user with rating privileges to a malicious page that auto-submits a POST to the ratings AJAX handler, modifying stored rating data without the victim’s intent. A vendor patch is indicated and an upstream fix exists in GitHub PR 1900, but no public exploit was identified at time of analysis.
Open redirect in Cotonti through 1.0.0 lets remote, unauthenticated attackers bounce victims to arbitrary attacker-controlled sites by supplying a hostname that merely begins with the legitimate site domain, defeating the cot_url_check() validation used by the ratings plugin and other redirect callers. Exploitation is constrained by required victim interaction - a user must follow a crafted link through a reachable redirect caller such as plugins/ratings/ratings.ajax.php - and yields only redirection to an attacker host, not code execution or data compromise, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N vector (CVSS 4.0 base 5.3). This is a low-severity, internally consistent issue with no public exploit identified at time of analysis; there is no evidence of active exploitation or KEV listing.
Cross-site request forgery in Cotonti 1.0.0's Personal File Storage module allows remote attackers to hijack authenticated user sessions to silently modify folder metadata. The folder update action ('a=update') in modules/pfs/inc/pfs.editfolder.php processes state-changing requests without invoking Cotonti's built-in anti-CSRF token validation function cot_check_xg(), enabling an attacker to force a logged-in user to unknowingly expose private folders or alter their descriptions. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV, but the specific vulnerable code commit is publicly identified by the reporter TuranSec.
Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page. [CVSS 5.4 MEDIUM]
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.