Cotonti
Cotonti Siena: vulnerabilidades y CVE
Cotonti Siena tiene 8 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE8
Últimos 12 meses3
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-58144 | Media (5.1) | 0.23% | — | 9 jul 2026 | Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle… |
| CVE-2026-58143 | Alta (8.7) | 0.24% | — | 9 jul 2026 | Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a… |
| CVE-2021-47808 | Media (5.1) | 0.27% | — | 16 ene 2026 | Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to… |
| CVE-2025-44115 | Media (5.4) | 0.27% | — | 2 jun 2025 | A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting. |
| CVE-2024-24115 | Media (5.4) | 0.40% | — | 8 feb 2024 | A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2022-39840 | Media (4.8) | 0.48% | — | 5 sept 2022 | Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). |
| CVE-2022-39839 | Media (4.8) | 0.48% | — | 5 sept 2022 | Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. |
| CVE-2013-4789 | Alta (7.5) | 2.6% | — | 9 ago 2013 | SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.