CVE-2021-47808

5.1 mediumEPSS 0.3%

Medium (5.1) in cotonti cotonti siena. EPSS 0.3% chance of exploitation in the next 30 days.

Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-11-01)
CWE: CWE-79
Published: 2026-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cotonti:cotonti_siena

References

https://cotonti.com
https://www.cotonti.com/download/
https://www.exploit-db.com/exploits/50016
https://www.vulncheck.com/advisories/cotonti-siena-maintitle-stored-cross-site-scripting
https://www.exploit-db.com/exploits/50016

Check your stack JSON