Cotonti vulnerabilities
We track 9 vulnerabilities in Cotonti products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Cotonti vulnerabilities
- 7.5 High severity
Cotonti: Deserialization of Untrusted Data
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file writ
- 8.1 High severity
Cotonti: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, prec
- 9.8 Critical severity
Cotonti: Deserialization of Untrusted Data
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object inject
- 7.6 High severity
Cotonti: Deserialization of Untrusted Data
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restri
- 8.8 High severity
Cotonti: Cross-Site Request Forgery
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config
- 7.6 High severity
Cotonti: Improper Neutralization of Input During Web Page Generation
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_impor
- 8.1 High severity
Cotonti: Cross-Site Request Forgery
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to
- 9.6 Critical severity
Cotonti: Cross-Site Request Forgery
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_gr
- 8.8 High severity
Cotonti: Cross-Site Request Forgery
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_opt