CVE-2026-93871
5.4 MEDIUMpublic exploit availablePublished 2026-09-18 · Updated 2026-09-22
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Public exploit & PoC references
All references
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/page/inc/page.main.php
- https://github.com/Cotonti/Cotonti/issues/1893
- https://github.com/Cotonti/Cotonti/pull/1901
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-stored-open-redirect-via-page-redir-prefix
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100523PoC
- CRITICALCVE-2026-101090PoC
- UNSCOREDCVE-2026-101907PoC
- UNSCOREDCVE-2026-103048
- MEDIUMCVE-2026-14219
- MEDIUMCVE-2026-16296
- MEDIUMCVE-2026-18505
- MEDIUMCVE-2026-53989PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.