CVE-2026-93870

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870

Cotonti through 1.0.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the ratings plugin AJAX handler (ratings.ajax.php). The root cause is a failure to validate anti-CSRF tokens, allowing an attacker to craft a malicious page that auto-submits POST requests to modify stored rating data ...

CVE-2026-93870: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...