Vulnerability Description
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
- https://github.com/Cotonti/Cotonti/issues/1907
- https://github.com/Cotonti/Cotonti/pull/1908
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-mes
FAQ
What is CVE-2026-100522?
CVE-2026-100522 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated a...
How severe is CVE-2026-100522?
CVE-2026-100522 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100522?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.