Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Cotonti — Vulnerabilities & Security Advisories 20

Browse all 20 CVE security advisories affecting Cotonti. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates security vulnerabilities associated with the Cotonti vendor. It collects publicly disclosed security flaws affecting Cotonti software products, covering the time range from the initial release of the platform through the most recent updates. Readers can use this index to track vendor security advisories, understand specific weakness classes such as cross-site scripting or SQL injection, and review the historical vulnerability profile of Cotonti applications. The data is organized to facilitate analysis of remediation patterns and recurring issues across different versions, providing a centralized reference for security professionals monitoring this software ecosystem. By examining these aggregated records, users can assess the overall security posture of deployments using Cotonti and identify potential risks that may persist across multiple updates. The focus remains on documented incidents, offering insight into the types of exploits developers have had to address over time. This collection serves as a technical resource for researchers and administrators seeking to contextualize current alerts within the broader history of the product line. It does not provide patching instructions but rather serves as a catalog of known defects, enabling better risk assessment and prioritization for organizations reliant on this content management system.

Found 20 results / 20 Clear Filters
Top products by Cotonti: Cotonti
CVE ID Title CVSS Severity Published
CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion — Cotonti CWE-352 5.4 Medium 2026-09-28
CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager — Cotonti CWE-352 5.4 Medium 2026-09-26
CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter — Cotonti CWE-79 6.1 Medium 2026-09-26
CVE-2026-100523 Cotonti through 1.0.0 Open Redirect via message.php redirect parameter — Cotonti CWE-601 6.1 Medium 2026-09-26
CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter — Cotonti CWE-79 6.1 Medium 2026-09-26
CVE-2026-93873 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin — Cotonti CWE-352 4.3 Medium 2026-09-18
CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter — Cotonti CWE-502 7.5 High 2026-09-18
CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix — Cotonti CWE-601 5.4 Medium 2026-09-18
CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler — Cotonti CWE-352 4.3 Medium 2026-09-18
CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG — Cotonti CWE-338 8.1 High 2026-09-18
CVE-2026-93869 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex — Cotonti CWE-601 6.1 Medium 2026-09-18
CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter — Cotonti CWE-502 9.8 Critical 2026-09-15
CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions — Cotonti CWE-502 7.7 High 2026-08-05
CVE-2026-58144 Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter — Cotonti CWE-79 5.4 Medium 2026-07-09
CVE-2026-58143 Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint — Cotonti CWE-352 8.8 High 2026-07-09
CVE-2026-55746 Cotonti stored XSS via PFS folder title — Cotonti CWE-79 7.6 High 2026-06-18
CVE-2026-55745 Cotonti CSRF in PFS folder edit allows unauthorized folder modification — Cotonti CWE-352 5.4 Medium 2026-06-18
CVE-2026-55744 Cotonti CSRF in PFS allows forced arbitrary file upload — Cotonti CWE-352 8.1 High 2026-06-18
CVE-2026-55742 Cotonti CSRF in admin.rights.php allows privilege escalation — Cotonti CWE-352 9.6 Critical 2026-06-18
CVE-2026-55741 Cotonti CSRF in admin.config.php allows unauthorized configuration changes — Cotonti CWE-352 8.8 High 2026-06-18

This page lists every published CVE security advisory associated with Cotonti. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.