Vulnerabilities

TI-2021-22424 CVE-2021-47808 · GHSA-gqqp-x5qv-896x

Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting

MEDIUM 56

Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00271 Published 2026-01-15 No fix listed CWE-79

TI-2025-28591 CVE-2025-44115 · GHSA-7wp3-36m3-58j5

A vulnerability has been found in Cotonti Siena v0.9.25.

MEDIUM 58

A vulnerability has been found in Cotonti Siena v0.9.25.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.003 Published 2025-06-02 No fix listed CWE-79

TI-2024-16007 CVE-2024-24115 · GHSA-p25h-32f2-ffm3

A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2024-02-08 No fix listed CWE-79

TI-2022-18834 CVE-2022-39839 · GHSA-5655-f6hp-27hx

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.

LOW 23

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00495 Published 2022-09-05 No fix listed CWE-79

TI-2022-18835 CVE-2022-39840 · GHSA-679x-5396-mpwf

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).

LOW 23

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00495 Published 2022-09-05 No fix listed CWE-79

TI-2013-04200 CVE-2013-4789 · GHSA-8x66-g6x3-phwh

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote…

LOW 38

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0261 Published 2013-08-09 No fix listed CWE-89

Vulnerabilities

Filters

Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting

A vulnerability has been found in Cotonti Siena v0.9.25.

A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti…

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).

SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote…