Skip to content
Threat Feed
Subscribe

Vendor

Cotonti

3 briefs RSS
high advisory

Insecure Deserialization in Cotonti Comments Plugin

Cotonti version 1.0.0 contains an insecure deserialization vulnerability in the comments plugin allowing authenticated users to trigger object injection and potential remote code execution.

Cotonti web-application deserialization vulnerability
1t 1c
critical advisory

Unauthenticated PHP Object Injection in Cotonti Comments Plugin

Cotonti 1.0.0 is vulnerable to unauthenticated remote code execution via a PHP object injection flaw in the Comments plugin's 'ci' GET parameter.

Comments plugin php-object-injection rce web-vulnerability
1r 1t 1c
high advisory

CVE-2026-58143 - Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows una...

A Cross-Site Request Forgery (CSRF) vulnerability in Cotonti Siena versions 0.9.26 and earlier allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request, enabling the upload and execution of arbitrary PHP files leading to remote code execution.

Cotonti Siena <= 0.9.26 cross-site-request-forgery vulnerability webserver rce php
1r 3t 1c