cotonti
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 13
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, cotonti recorded 13 security vulnerabilities in the last 90 days across 1 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cotonti had the most security vulnerabilities in the cotonti ecosystem, with 13 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121553Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())CVE-2026-101093Cotonti through 1.0.0 Cross-Site Request Forgery via User Group DeletionCVE-2026-100524Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions ManagerCVE-2026-100523Cotonti through 1.0.0 Open Redirect via message.php redirect parameterCVE-2026-100522Cotonti through 1.0.0 Reflected XSS via message.php lng parameter| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-121553Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) | Exploitation statusNot confirmed | FixYes |
| Published11/03/2026 |
| SeverityMedium |
CVE-2026-101093Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-100524Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100523Cotonti through 1.0.0 Open Redirect via message.php redirect parameter | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100522Cotonti through 1.0.0 Reflected XSS via message.php lng parameter | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100521Cotonti through 1.0.0 Reflected XSS via search highlight parameter | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-93873Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93872Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter | Exploitation statusNot exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityHigh |
|---|
CVE-2026-93871Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93870Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93869Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-93868Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/18/2026 | SeverityCritical |
|---|
CVE-2026-91939Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter | Exploitation statusActively exploited | FixYes | Affected productcotonti | Published09/15/2026 | SeverityCritical |
|---|
CVE-2026-71294Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published08/05/2026 | SeverityHigh |
|---|
CVE-2026-58144Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter | Exploitation statusActively exploited | FixNo | Affected productcotonti | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-58143Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint | Exploitation statusActively exploited | FixNo | Affected productcotonti | Published07/09/2026 | SeverityHigh |
|---|
CVE-2026-55746Cotonti stored XSS via PFS folder title | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published06/18/2026 | SeverityHigh |
|---|
CVE-2026-55745Cotonti CSRF in PFS folder edit allows unauthorized folder modification | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published06/18/2026 | SeverityMedium |
|---|
CVE-2026-55744Cotonti CSRF in PFS allows forced arbitrary file upload | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published06/18/2026 | SeverityHigh |
|---|
CVE-2026-55742Cotonti CSRF in admin.rights.php allows privilege escalation | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published06/18/2026 | SeverityCritical |
|---|
CVE-2026-55741Cotonti CSRF in admin.config.php allows unauthorized configuration changes | Exploitation statusNot exploited | FixNo | Affected productcotonti | Published06/18/2026 | SeverityHigh |
|---|
21 Results | Page 1 of 1