Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (27 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-55741 1 Cotonti 1 Cotonti 2026-08-10 8.8 High
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).
CVE-2021-47808 1 Cotonti 1 Cotonti Siena 2026-04-07 5.4 Medium
Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.
CVE-2024-24115 1 Cotonti 1 Cotonti Siena 2026-01-23 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2025-44115 1 Cotonti 1 Cotonti Siena 2025-06-13 5.4 Medium
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
CVE-2013-4789 1 Cotonti 1 Cotonti Siena 2025-04-11 N/A
SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
CVE-2022-39840 1 Cotonti 1 Cotonti Siena 2024-11-21 4.8 Medium
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).
CVE-2022-39839 1 Cotonti 1 Cotonti Siena 2024-11-21 4.8 Medium
Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.