Product
Cotonti 1.0.0 is vulnerable to unauthenticated remote code execution via a PHP object injection flaw in the Comments plugin's 'ci' GET parameter.