CVE-2026-100522

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-26
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
https://github.com/Cotonti/Cotonti/issues/1907
https://github.com/Cotonti/Cotonti/pull/1908
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter

Check your stack JSON