Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Cotonti — Vulnerabilities & Security Advisories 20

All 20 CVE vulnerabilities found in Cotonti, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the Cotonti content management system, focusing on security weaknesses within the open-source software category. It collects a comprehensive set of known flaws, including injection points, access control defects, and cross-site scripting risks, covering the advisory history from the product's initial release through the most recent disclosed issues. Here you can track the vendor's published security advisories, understand the specific weakness classes associated with this platform, and review the complete vulnerability history of the product to identify recurring patterns or emerging threats.

Vendor: Cotonti

CVE ID Title CVSS Severity Published
CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion CWE-352 5.4 Medium 2026-09-28
CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager CWE-352 5.4 Medium 2026-09-26
CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter CWE-79 6.1 Medium 2026-09-26
CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter CWE-601 6.1 Medium 2026-09-26
CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter CWE-79 6.1 Medium 2026-09-26
CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin CWE-352 4.3 Medium 2026-09-18
CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter CWE-502 7.5 High 2026-09-18
CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix CWE-601 5.4 Medium 2026-09-18
CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler CWE-352 4.3 Medium 2026-09-18
CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG CWE-338 8.1 High 2026-09-18
CVE-2026-93869 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex CWE-601 6.1 Medium 2026-09-18
CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter CWE-502 9.8 Critical 2026-09-15
CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions CWE-502 7.7 High 2026-08-05
CVE-2026-58144 Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter CWE-79 5.4 Medium 2026-07-09
CVE-2026-58143 Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint CWE-352 8.8 High 2026-07-09
CVE-2026-55746 Cotonti stored XSS via PFS folder title CWE-79 7.6 High 2026-06-18
CVE-2026-55745 Cotonti CSRF in PFS folder edit allows unauthorized folder modification CWE-352 5.4 Medium 2026-06-18
CVE-2026-55744 Cotonti CSRF in PFS allows forced arbitrary file upload CWE-352 8.1 High 2026-06-18
CVE-2026-55742 Cotonti CSRF in admin.rights.php allows privilege escalation CWE-352 9.6 Critical 2026-06-18
CVE-2026-55741 Cotonti CSRF in admin.config.php allows unauthorized configuration changes CWE-352 8.8 High 2026-06-18

All 20 known CVE vulnerabilities affecting Cotonti with full Chinese analysis, references, and POCs where available.