CVE-2013-4789

CVE-2013-4789 is a SQL injection vulnerability in Cotonti where the param c is unsafely handled in index.php when e=rss, allowing remote attackers to execute arbitrary SQL commands. Affected: Cotonti releases before 0.9.14. Root cause: inadequate filtration/validation of the GET parameter, enabli...

CVE-2025-44115

CVE-2025-44115 affects Cotonti Siena v0.9.25. The vulnerability is a cross-site scripting (XSS) flaw in the admin endpoint at /admin.php?m=config&n=edit&o=core&p=title where the value of the title parameter can be manipulated to inject script. According to connected sources, exploitation requires...

CVE-2022-39839

CVE-2022-39839 : Cotonti Siena 0.9.20 is affected by a stored XSS vulnerability via forum posts. The CVE entry documents the issue and the NVD CVSSv3.1 base score of 4.8 (Medium), with network attack vector, low attack complexity, privileges required high, user interaction required, and a changed...

CVE-2022-39840

CVE-2022-39840 affects Cotonti Siena 0.9.20, enabling stored XSS via direct messages (DM). Impact: admin-level content processing could be manipulated to execute scripts; CVSS 3.1 base score 4.8 (MEDIUM) with network vector, low attack complexity, user interaction required. Root cause details are...

CVE-2024-24115

CVE-2024-24115 concerns a stored XSS vulnerability in the Edit Page feature of Cotonti CMS v0.9.24. According to the documents, authenticated attackers can inject and execute arbitrary web scripts or HTML via a crafted payload. The vulnerability is described consistently across multiple sources; ...

CVE-2021-47808

CVE-2021-47808 relates to Cotonti Siena 0.9.19, exposing a stored cross-site scripting (XSS) vulnerability in the admin configuration panel’s site title parameter. The issue allows injection of JavaScript through the ‘maintitle’ field, enabling script execution when administrators view the page. ...