Skip to content
OpenAdvisories

Vendor

cotonti

21 known vulnerabilities.

Products

cotonti 21
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-93872

    Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

    Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file wri…

    cotonti cotonti
  • High 8.1
    CVE-2026-93868

    Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

    Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, pre…

    cotonti cotonti
  • High 7.7
    CVE-2026-71294 Public exploit

    Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

    Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restr…

    cotonti cotonti
  • High 8.8
    CVE-2026-58143

    Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint

    Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php confi…

    cotonti cotonti
  • High 7.6
    CVE-2026-55746

    Cotonti stored XSS via PFS folder title

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_impo…

    cotonti cotonti cotonti/cotonti Packagist
  • High 8.1
    CVE-2026-55744

    Cotonti CSRF in PFS allows forced arbitrary file upload

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to…

    cotonti cotonti cotonti/cotonti Packagist
  • High 8.8
    CVE-2026-55741

    Cotonti CSRF in admin.config.php allows unauthorized configuration changes

    Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_op…

    cotonti cotonti