Reflected Cross-Site Scripting Vulnerability in Cotonti Web Platform
CVE-2026-100522

5.1MEDIUM

Key Information:

Vendor

Cotonti

Status
Cotonti
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100522?

Cotonti up to version 1.0.0 has a reflected cross-site scripting vulnerability in the message.php file. The issue arises from the lng parameter, which is not properly escaped before being displayed in confirmation dialogs. This flaw allows unauthenticated attackers to create malicious links that include script payloads in the lng parameter, enabling the execution of arbitrary JavaScript in the browsers of unsuspecting users.

Affected Version(s)

Cotonti 0 <= 1.0.0

References

https://github.com/Cotonti/Cotonti/issues/1907
issue-tracking
https://github.com/Cotonti/Cotonti/pull/1908
issue-trackingpatch
https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Harsh Raj Singhania
.