CVE-2026-58144
Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter
CVSS Score
5.4
EPSS Score
0.1%
EPSS Percentile
3th
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.
| CWE | CWE-79 |
| Vendor | cotonti |
| Product | cotonti |
| Published | Jul 9, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for cotonti cotonti
Be the first to know when new medium vulnerabilities affecting cotonti cotonti are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Cotonti / Cotonti
0 ≤ 0.9.26
References
Credits
Saidakbarxon Maxsudxonov