CVE-2026-100522

6.1 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
https://github.com/Cotonti/Cotonti/issues/1907
https://github.com/Cotonti/Cotonti/pull/1908

All references

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
https://github.com/Cotonti/Cotonti/issues/1907
https://github.com/Cotonti/Cotonti/pull/1908
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-13533PoC
MEDIUMCVE-2025-14814
LOWCVE-2025-15677
MEDIUMCVE-2025-15696
LOWCVE-2025-15698
MEDIUMCVE-2025-36147
HIGHCVE-2025-61682PoC
MEDIUMCVE-2025-71419PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.