Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
42 vulnerabilities by cotonti
CVE-2026-93873 (GCVE-0-2026-93873)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 20:21
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:20 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1895 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1903 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93873",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:20:44.146800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:09.601Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/contact/contact.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:38.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1903"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/contact/contact.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-contact-plugin"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93873",
"datePublished": "2026-09-18T19:56:38.530Z",
"dateReserved": "2026-09-18T19:39:42.366Z",
"dateUpdated": "2026-09-18T20:21:09.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93872 (GCVE-0-2026-93872)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Summary
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1894 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1897 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/sys… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-1.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/comments/controllers/actions/EditAction.php",
"system/cache.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:37.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1894"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1897"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/EditAction.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/system/cache.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-1.0.0-php-object-injection-via-comments-plugin-edit-action-cb-parameter"
}
],
"title": "Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93872",
"datePublished": "2026-09-18T19:56:37.540Z",
"dateReserved": "2026-09-18T19:39:42.007Z",
"dateUpdated": "2026-09-18T19:56:37.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93871 (GCVE-0-2026-93871)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Summary
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
Severity
5.4 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1893 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1901 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"modules/page/inc/page.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:36.840Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1893"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1901"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/page/inc/page.main.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-stored-open-redirect-via-page-redir-prefix"
}
],
"title": "Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93871",
"datePublished": "2026-09-18T19:56:36.840Z",
"dateReserved": "2026-09-18T19:39:41.099Z",
"dateUpdated": "2026-09-18T19:56:36.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93870 (GCVE-0-2026-93870)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
Severity
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1892 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1900 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/ratings/ratings.ajax.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:36.178Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1892"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1900"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-ratings-plugin-ajax-handler"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93870",
"datePublished": "2026-09-18T19:56:36.178Z",
"dateReserved": "2026-09-18T19:39:36.923Z",
"dateUpdated": "2026-09-18T19:56:36.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93869 (GCVE-0-2026-93869)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Summary
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Severity
6.1 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1891 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1899 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/sys… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"system/functions.php",
"plugins/ratings/ratings.ajax.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:35.457Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1891"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1899"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/system/functions.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-open-redirect-via-unanchored-cot-url-check-regex"
}
],
"title": "Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93869",
"datePublished": "2026-09-18T19:56:35.457Z",
"dateReserved": "2026-09-18T19:39:36.562Z",
"dateUpdated": "2026-09-18T19:56:35.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93868 (GCVE-0-2026-93868)
Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-18 20:20
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
Summary
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:19 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1890 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1898 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:19:56.767733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:20:21.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1890"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"modules/users/inc/users.passrecover.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:34.779Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1890"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1898"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng"
}
],
"title": "Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93868",
"datePublished": "2026-09-18T19:56:34.779Z",
"dateReserved": "2026-09-18T19:39:36.206Z",
"dateUpdated": "2026-09-18T20:20:21.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91939 (GCVE-0-2026-91939)
Vulnerability from nvd – Published: 2026-09-15 20:56 – Updated: 2026-09-16 19:18
VLAI
EPSS
VEX
Title
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Summary
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1888 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1889 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-1.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91939",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:17:38.681650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:18:18.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1888"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/comments/inc/CommentsWidget.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:45.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1888",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1888"
},
{
"name": "Proposed fix PR #1889 (unmerged)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1889"
},
{
"name": "CommentsWidget::run() at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php"
},
{
"name": "AJAX display controller at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/DisplayAction.php"
},
{
"name": "Default comments permissions at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter"
}
],
"title": "Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91939",
"datePublished": "2026-09-15T20:56:45.058Z",
"dateReserved": "2026-09-15T11:07:01.912Z",
"dateUpdated": "2026-09-16T19:18:18.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71294 (GCVE-0-2026-71294)
Vulnerability from nvd – Published: 2026-08-05 12:38 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
Summary
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:35 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti | third-party-advisory |
| https://github.com/Cotonti/Cotonti/blob/master/pl… | third-party-advisory |
Date Public
2026-08-05 12:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:35:00.816320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:35:10.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cotonti",
"programFiles": [
"plugins/comments/controllers/actions/CreateAction.php",
"plugins/comments/controllers/actions/EditAction.php"
],
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-08-05T12:38:48.025Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti CMS\u0027s Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).\u003c/p\u003e"
}
],
"value": "Cotonti CMS\u0027s Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:30.270Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71294",
"datePublished": "2026-08-05T12:38:48.025Z",
"dateReserved": "2026-08-05T12:37:57.358Z",
"dateUpdated": "2026-08-10T11:47:30.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58144 (GCVE-0-2026-58144)
Vulnerability from nvd – Published: 2026-07-09 22:07 – Updated: 2026-07-14 21:34 X_Open Source
VLAI
EPSS
VEX
Title
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter
Summary
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 13:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://gist.github.com/sermikr0/75686815e441c074… | technical-descriptionexploit |
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58144",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T13:40:26.781834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T13:40:38.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/Cotonti/Cotonti",
"product": "Cotonti",
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "0.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T21:34:51.965Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58144",
"datePublished": "2026-07-09T22:07:11.370Z",
"dateReserved": "2026-06-29T14:13:18.385Z",
"dateUpdated": "2026-07-14T21:34:51.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58143 (GCVE-0-2026-58143)
Vulnerability from nvd – Published: 2026-07-09 22:04 – Updated: 2026-07-14 21:34 X_Open Source
VLAI
EPSS
VEX
Title
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
Summary
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 14:40 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://gist.github.com/sermikr0/75686815e441c074… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/cotonti-sien… | third-party-advisory |
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58143",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:40:45.545297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:40:53.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/Cotonti/Cotonti",
"product": "Cotonti",
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "0.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application\u0027s CSRF validation function. Attackers can disable the PFS module\u0027s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T21:34:51.284Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-siena-csrf-via-admin-php-config-update-endpoint"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58143",
"datePublished": "2026-07-09T22:04:22.946Z",
"dateReserved": "2026-06-29T14:13:18.385Z",
"dateUpdated": "2026-07-14T21:34:51.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55746 (GCVE-0-2026-55746)
Vulnerability from nvd – Published: 2026-06-18 06:46 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti stored XSS via PFS folder title
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:46
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:31:56.717274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:32:08.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:46:57.622Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the \u0027TXT\u0027 filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the \u0027TXT\u0027 filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:31.612Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.main.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L396"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti stored XSS via PFS folder title"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55746",
"datePublished": "2026-06-18T06:46:57.622Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:31.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55745 (GCVE-0-2026-55745)
Vulnerability from nvd – Published: 2026-06-18 06:07 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in PFS folder edit allows unauthorized folder modification
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:53 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:53:00.493151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:53:11.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.editfolder.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:07:27.281Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action (\u0027a=update\u0027) updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action (\u0027a=update\u0027) updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:29.461Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.editfolder.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.editfolder.php#L90"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in PFS folder edit allows unauthorized folder modification"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55745",
"datePublished": "2026-06-18T06:07:27.281Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:29.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55744 (GCVE-0-2026-55744)
Vulnerability from nvd – Published: 2026-06-18 06:06 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in PFS allows forced arbitrary file upload
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:52 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:06
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:52:14.807252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:52:24.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:06:57.715Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action (\u0027a=upload\u0027) processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as \u0027delete\u0027 (line 272) do.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action (\u0027a=upload\u0027) processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as \u0027delete\u0027 (line 272) do."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:27.344Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.main.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L118"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in PFS allows forced arbitrary file upload"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55744",
"datePublished": "2026-06-18T06:06:57.715Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:27.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55742 (GCVE-0-2026-55742)
Vulnerability from nvd – Published: 2026-06-18 06:05 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in admin.rights.php allows privilege escalation
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:54 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:54:26.923984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:54:36.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"system/admin/admin.rights.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:05:46.915Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action (\u0027a=update\u0027) modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action (\u0027a=update\u0027) modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:23.141Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: system/admin/admin.rights.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.rights.php#L53"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in admin.rights.php allows privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55742",
"datePublished": "2026-06-18T06:05:46.915Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:23.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55741 (GCVE-0-2026-55741)
Vulnerability from nvd – Published: 2026-06-18 06:04 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in admin.config.php allows unauthorized configuration changes
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:53 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:53:45.770119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:53:57.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"system/admin/admin.config.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:04:19.527Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action (\u0027a=update\u0027) processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the \u0027x\u0027 parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action (\u0027a=update\u0027) processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the \u0027x\u0027 parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:21.075Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: system/admin/admin.config.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.config.php#L55"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in admin.config.php allows unauthorized configuration changes"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55741",
"datePublished": "2026-06-18T06:04:19.527Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:21.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93873 (GCVE-0-2026-93873)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 20:21
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:20 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1895 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1903 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93873",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:20:44.146800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:09.601Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/contact/contact.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:38.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1895"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1903"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/contact/contact.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-contact-plugin"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93873",
"datePublished": "2026-09-18T19:56:38.530Z",
"dateReserved": "2026-09-18T19:39:42.366Z",
"dateUpdated": "2026-09-18T20:21:09.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93872 (GCVE-0-2026-93872)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Summary
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1894 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1897 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/sys… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-1.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/comments/controllers/actions/EditAction.php",
"system/cache.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:37.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1894"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1897"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/EditAction.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/system/cache.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-1.0.0-php-object-injection-via-comments-plugin-edit-action-cb-parameter"
}
],
"title": "Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93872",
"datePublished": "2026-09-18T19:56:37.540Z",
"dateReserved": "2026-09-18T19:39:42.007Z",
"dateUpdated": "2026-09-18T19:56:37.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93871 (GCVE-0-2026-93871)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Summary
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
Severity
5.4 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1893 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1901 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"modules/page/inc/page.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:36.840Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1893"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1901"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/page/inc/page.main.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-stored-open-redirect-via-page-redir-prefix"
}
],
"title": "Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93871",
"datePublished": "2026-09-18T19:56:36.840Z",
"dateReserved": "2026-09-18T19:39:41.099Z",
"dateUpdated": "2026-09-18T19:56:36.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93870 (GCVE-0-2026-93870)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
Summary
Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users.
Severity
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1892 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1900 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/ratings/ratings.ajax.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:36.178Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1892"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1900"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-in-the-ratings-plugin-ajax-handler"
}
],
"title": "Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93870",
"datePublished": "2026-09-18T19:56:36.178Z",
"dateReserved": "2026-09-18T19:39:36.923Z",
"dateUpdated": "2026-09-18T19:56:36.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93869 (GCVE-0-2026-93869)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 19:56
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Summary
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Severity
6.1 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1891 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1899 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/sys… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"system/functions.php",
"plugins/ratings/ratings.ajax.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:35.457Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1891"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1899"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/system/functions.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-open-redirect-via-unanchored-cot-url-check-regex"
}
],
"title": "Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93869",
"datePublished": "2026-09-18T19:56:35.457Z",
"dateReserved": "2026-09-18T19:39:36.562Z",
"dateUpdated": "2026-09-18T19:56:35.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93868 (GCVE-0-2026-93868)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-18 20:20
VLAI
EPSS
VEX
Title
Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
Summary
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:19 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1890 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1898 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/mod… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-thro… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:19:56.767733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:20:21.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1890"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"modules/users/inc/users.passrecover.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:56:34.779Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1890"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1898"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng"
}
],
"title": "Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93868",
"datePublished": "2026-09-18T19:56:34.779Z",
"dateReserved": "2026-09-18T19:39:36.206Z",
"dateUpdated": "2026-09-18T20:20:21.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91939 (GCVE-0-2026-91939)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:56 – Updated: 2026-09-16 19:18
VLAI
EPSS
VEX
Title
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Summary
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/issues/1888 | issue-tracking |
| https://github.com/Cotonti/Cotonti/pull/1889 | patchissue-tracking |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plu… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
| https://www.vulncheck.com/advisories/cotonti-1.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91939",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:17:38.681650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:18:18.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1888"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/cotonti/cotonti",
"product": "Cotonti",
"programFiles": [
"plugins/comments/inc/CommentsWidget.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Harsh Raj Singhania"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:56:45.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1888",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/issues/1888"
},
{
"name": "Proposed fix PR #1889 (unmerged)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Cotonti/Cotonti/pull/1889"
},
{
"name": "CommentsWidget::run() at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php"
},
{
"name": "AJAX display controller at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/DisplayAction.php"
},
{
"name": "Default comments permissions at 1.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"name": "VulnCheck Advisory: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter"
}
],
"title": "Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91939",
"datePublished": "2026-09-15T20:56:45.058Z",
"dateReserved": "2026-09-15T11:07:01.912Z",
"dateUpdated": "2026-09-16T19:18:18.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71294 (GCVE-0-2026-71294)
Vulnerability from cvelistv5 – Published: 2026-08-05 12:38 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
Summary
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:35 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti | third-party-advisory |
| https://github.com/Cotonti/Cotonti/blob/master/pl… | third-party-advisory |
Date Public
2026-08-05 12:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:35:00.816320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:35:10.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cotonti",
"programFiles": [
"plugins/comments/controllers/actions/CreateAction.php",
"plugins/comments/controllers/actions/EditAction.php"
],
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-08-05T12:38:48.025Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti CMS\u0027s Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).\u003c/p\u003e"
}
],
"value": "Cotonti CMS\u0027s Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:30.270Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Cotonti/Cotonti"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71294",
"datePublished": "2026-08-05T12:38:48.025Z",
"dateReserved": "2026-08-05T12:37:57.358Z",
"dateUpdated": "2026-08-10T11:47:30.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58144 (GCVE-0-2026-58144)
Vulnerability from cvelistv5 – Published: 2026-07-09 22:07 – Updated: 2026-07-14 21:34 X_Open Source
VLAI
EPSS
VEX
Title
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter
Summary
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 13:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://gist.github.com/sermikr0/75686815e441c074… | technical-descriptionexploit |
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58144",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T13:40:26.781834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T13:40:38.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/Cotonti/Cotonti",
"product": "Cotonti",
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "0.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T21:34:51.965Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58144",
"datePublished": "2026-07-09T22:07:11.370Z",
"dateReserved": "2026-06-29T14:13:18.385Z",
"dateUpdated": "2026-07-14T21:34:51.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58143 (GCVE-0-2026-58143)
Vulnerability from cvelistv5 – Published: 2026-07-09 22:04 – Updated: 2026-07-14 21:34 X_Open Source
VLAI
EPSS
VEX
Title
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
Summary
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 14:40 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://gist.github.com/sermikr0/75686815e441c074… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/cotonti-sien… | third-party-advisory |
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58143",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:40:45.545297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:40:53.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/Cotonti/Cotonti",
"product": "Cotonti",
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"lessThanOrEqual": "0.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application\u0027s CSRF validation function. Attackers can disable the PFS module\u0027s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T21:34:51.284Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cotonti-siena-csrf-via-admin-php-config-update-endpoint"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58143",
"datePublished": "2026-07-09T22:04:22.946Z",
"dateReserved": "2026-06-29T14:13:18.385Z",
"dateUpdated": "2026-07-14T21:34:51.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55746 (GCVE-0-2026-55746)
Vulnerability from cvelistv5 – Published: 2026-06-18 06:46 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti stored XSS via PFS folder title
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:31 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:46
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:31:56.717274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:32:08.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:46:57.622Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the \u0027TXT\u0027 filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the \u0027TXT\u0027 filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:31.612Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.main.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L396"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti stored XSS via PFS folder title"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55746",
"datePublished": "2026-06-18T06:46:57.622Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:31.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55745 (GCVE-0-2026-55745)
Vulnerability from cvelistv5 – Published: 2026-06-18 06:07 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in PFS folder edit allows unauthorized folder modification
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:53 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:53:00.493151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:53:11.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.editfolder.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:07:27.281Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action (\u0027a=update\u0027) updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action (\u0027a=update\u0027) updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:29.461Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.editfolder.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.editfolder.php#L90"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in PFS folder edit allows unauthorized folder modification"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55745",
"datePublished": "2026-06-18T06:07:27.281Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:29.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55744 (GCVE-0-2026-55744)
Vulnerability from cvelistv5 – Published: 2026-06-18 06:06 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in PFS allows forced arbitrary file upload
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:52 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:06
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:52:14.807252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:52:24.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"modules/pfs/inc/pfs.main.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:06:57.715Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action (\u0027a=upload\u0027) processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as \u0027delete\u0027 (line 272) do.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action (\u0027a=upload\u0027) processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as \u0027delete\u0027 (line 272) do."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:27.344Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: modules/pfs/inc/pfs.main.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L118"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in PFS allows forced arbitrary file upload"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55744",
"datePublished": "2026-06-18T06:06:57.715Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:27.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55742 (GCVE-0-2026-55742)
Vulnerability from cvelistv5 – Published: 2026-06-18 06:05 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in admin.rights.php allows privilege escalation
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:54 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:54:26.923984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:54:36.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"system/admin/admin.rights.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:05:46.915Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action (\u0027a=update\u0027) modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action (\u0027a=update\u0027) modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:23.141Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: system/admin/admin.rights.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.rights.php#L53"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in admin.rights.php allows privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55742",
"datePublished": "2026-06-18T06:05:46.915Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:23.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55741 (GCVE-0-2026-55741)
Vulnerability from cvelistv5 – Published: 2026-06-18 06:04 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Cotonti CSRF in admin.config.php allows unauthorized configuration changes
Summary
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 12:53 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cotonti/Cotonti/blob/f43f1fc38… | technical-description |
| https://github.com/Cotonti/Cotonti | product |
Date Public
2026-06-18 06:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T12:53:45.770119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T12:53:57.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Cotonti/Cotonti",
"defaultStatus": "affected",
"product": "Cotonti",
"programFiles": [
"system/admin/admin.config.php"
],
"repo": "https://github.com/Cotonti/Cotonti",
"vendor": "Cotonti",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov (sermikro), Innova Networks"
}
],
"datePublic": "2026-06-18T06:04:19.527Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action (\u0027a=update\u0027) processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the \u0027x\u0027 parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).\u003c/p\u003e"
}
],
"value": "Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action (\u0027a=update\u0027) processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the \u0027x\u0027 parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:21.075Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Vulnerable code: system/admin/admin.config.php",
"tags": [
"technical-description"
],
"url": "https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.config.php#L55"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cotonti/Cotonti"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cotonti CSRF in admin.config.php allows unauthorized configuration changes"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-55741",
"datePublished": "2026-06-18T06:04:19.527Z",
"dateReserved": "2026-06-17T12:59:17.621Z",
"dateUpdated": "2026-08-10T11:44:21.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}