[ Vendor · 5 CVEs ]
Cotonti
CVEs affecting Cotonti published in the last 30 days, plus any Cotonti CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101093 | 28 Sep 2026 | CVSS 5.4 | CotontiCotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without… | |
| CVE-2026-100524 | 26 Sep 2026 | CVSS 5.4 | CotontiCotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing… | |
| CVE-2026-100521 | 26 Sep 2026 | CVSS 6.1 | CotontiCotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or… | |
| CVE-2026-100522 | 26 Sep 2026 | CVSS 6.1 | CotontiCotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before… | |
| CVE-2026-100523 | 26 Sep 2026 | CVSS 6.1 | CotontiCotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation… |