CVE-2026-91939— Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Quick assessment
Affected
Cotonti Cotonti
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cotonti 1.0.0 版本的 Comments 插件在将 GET 参数传递给 时，未对允许反序列化的类（ ）进行限制，这使得未经身份验证的攻击者能够实例化带有攻击者可控属性的任意 PHP 类。攻击者可以通过构造序列化负载（payload）触发 PHP 对象注入，进而利用小工具链（gadget chains）实现数据库操纵或代码执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91939
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-91939
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91939
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-91939 (2)
Vendor Advisories for CVE-2026-91939 (1)
Proof of Concept for CVE-2026-91939 (1)
Vendor Pages for CVE-2026-91939 (1)
Other References for CVE-2026-91939 (2)
IV. Related Vulnerabilities
Same product: Cotonti
-
CVE-2026-71294
Cotonti CMS Comments Plugin PHP Object Injection via Unrestr -
CVE-2026-58144
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parame -
CVE-2026-58143
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoi -
CVE-2026-55746
Cotonti stored XSS via PFS folder title -
CVE-2026-55745
Cotonti CSRF in PFS folder edit allows unauthorized folder m
Same vendor: Cotonti
-
CVE-2026-71294
Cotonti CMS Comments Plugin PHP Object Injection via Unrestr -
CVE-2026-58144
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parame -
CVE-2026-58143
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoi -
CVE-2026-55746
Cotonti stored XSS via PFS folder title -
CVE-2026-55745
Cotonti CSRF in PFS folder edit allows unauthorized folder m
Same weakness: CWE-502
-
CVE-2026-20307
Cisco Identity Services Engine Remote Code Execution Vulnera -
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization -
CVE-2026-70416
Dell ObjectScale 4.4.0前 不可信数据反序列化远程代码执行 -
CVE-2026-11729
IBM MQ Java messaging is vulnerable to remote code execution -
CVE-2023-54398
Yonyou U8 Cloud Java Deserialization RCE via FileManageServl
V. Comments for CVE-2026-91939
No comments yet