Advisories · Technology
cotonti.
Every CVE that names cotonti among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
- cotonti
- Weak cryptography or TLS
- CVSS 5.3 Medium
Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
Cotonti through 1.0.0 Open Redirect via message.php redirect parameter
- Cotonti
- Open redirect
- CVSS 5.1 Medium
Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
- Cotonti
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cotonti through 1.0.0 Reflected XSS via search highlight parameter
- Cotonti
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 7.7 High
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
- Cotonti
- Insecure deserialization
- CVSS 5.1 Medium
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
- Cotonti
- Open redirect
- CVSS 5.3 Medium
Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
- Cotonti
- Open redirect
- CVSS 9.2 CriticalCritical · CVSS 9+
Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
- Cotonti
- Weak cryptography or TLS
- CVSS 9.3 CriticalCritical · CVSS 9+
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
- Cotonti
- Insecure deserialization
- CVSS 7.7 High
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
- Cotonti
- Insecure deserialization
- CVSS 5.1 Medium
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter
- Cotonti
- Cross-site scripting (XSS)
- CVSS 8.7 High
Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
- Cotonti
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Cotonti CSRF in admin.config.php allows unauthorized configuration changes
- Cotonti
- Cross-site request forgery (CSRF)