CCotonti

Products

Exploited and recent CVEs

• CVE-2026-121553 Medium 4.8 Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) 0.4%
• CVE-2026-101093 Medium 5.4 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion 0.1%
• CVE-2026-100524 Medium 5.4 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager 0.1%
• CVE-2026-100523 Medium 6.1 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter 0.2%
• CVE-2026-100522 Medium 6.1 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter 0.2%
• CVE-2026-100521 Medium 6.1 Cotonti through 1.0.0 Reflected XSS via search highlight parameter 0.2%
• CVE-2026-93873 Medium 4.3 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin 0.2%
• CVE-2026-93872 High 7.5 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter 0.7%
• CVE-2026-93871 Medium 5.4 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix 0.3%
• CVE-2026-93870 Medium 4.3 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler 0.2%
• CVE-2026-93869 Medium 6.1 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex 0.4%
• CVE-2026-93868 High 8.1 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG 0.7%
• CVE-2026-91939 Critical 9.8 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter 1.0%
• CVE-2026-71294 High 7.7 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions 0.4%
• CVE-2026-58144 Medium 5.4 Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter 0.2%
• CVE-2026-58143 High 8.8 Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint 0.2%
• CVE-2026-55746 High 7.6 Cotonti stored XSS via PFS folder title 0.2%
• CVE-2026-55745 Medium 5.4 Cotonti CSRF in PFS folder edit allows unauthorized folder modification <0.1%
• CVE-2026-55744 High 8.1 Cotonti CSRF in PFS allows forced arbitrary file upload 0.1%
• CVE-2026-55742 Critical 9.6 Cotonti CSRF in admin.rights.php allows privilege escalation 0.2%
• CVE-2026-55741 High 8.8 Cotonti CSRF in admin.config.php allows unauthorized configuration changes 0.1%