Cotonti

cotonti

6 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-47808 1Cotonti 1Cotonti Siena Jun 17, 2026 Jan 16, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execu...Show more Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.Show less
CVE-2025-44115 1Cotonti 1Cotonti Siena Jun 17, 2026 Jun 2, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
CVE-2024-24115 1Cotonti 1Cotonti Siena Jun 17, 2026 Feb 8, 2024 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2022-39840 1Cotonti 1Cotonti Siena Jun 17, 2026 Sep 5, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).
CVE-2022-39839 1Cotonti 1Cotonti Siena Jun 17, 2026 Sep 5, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.
CVE-2013-4789 1Cotonti 1Cotonti Siena Apr 29, 2026 Aug 9, 2013 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.