Vulnerabilities
5 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-47808 | Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page. NVD description · AI analysis pending | 5.1 | <1% | PoC |
| — | |
| CVE-2025-44115 | A vulnerability has been found in Cotonti Siena v0.9.25. A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting. NVD description · AI analysis pending | 5.4 | <1% | PoC ×2 |
| — | |
| CVE-2024-24115 | A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scrip A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2022-39840 +1 in the same advisory: …39839 | Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). NVD description · AI analysis pending | 4.8 | <1% | PoC |
| — |