{"id":"CVE-2026-100524","published":"2026-09-26T01:17:01.040","lastModified":"2026-09-30T01:16:32.800","description":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Cotonti/Cotonti","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","tags":[]},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-extensions-manager","tags":[]}],"exploitRefs":[{"url":"https://github.com/Cotonti/Cotonti","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","tags":[]}],"hasPoc":true,"ai":null}