CVE-2026-100522
Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.
| CWE | CWE-79 |
| Vendor | cotonti |
| Product | cotonti |
| Published | Sep 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for cotonti cotonti
Be the first to know when new medium vulnerabilities affecting cotonti cotonti are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Cotonti / Cotonti
0 ≤ 1.0.0
References
github.com: https://github.com/Cotonti/Cotonti/issues/1907 github.com: https://github.com/Cotonti/Cotonti/pull/1908 github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php github.com: https://github.com/Cotonti/Cotonti vulncheck.com: https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter
Credits
Harsh Raj Singhania