# Cotonti vulnerabilities Source: https://junglewise.ai/threats/technologies/cotonti Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cotonti.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Cotonti: 0 in the last 7 days and 12 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121553, was published on 3 November 2026. 1 vulnerability in the last four weeks, down 91% on the four before (11). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 12 - All time: 17 (1 critical, 0 exploited in the wild) ## About Cotonti Cotonti is an open-source content management system and community framework based on the Siena engine. ## Latest Cotonti vulnerabilities - [CVE-2026-121553: Cotonti weak token generation in user registration](https://junglewise.ai/threats/cve-2026-121553-cotonti-through-1-0-0-generates-registration-and-email-change) (medium, CVSS 4.8, published 3 Nov 2026) - [CVE-2026-101093: Cotonti cross-site request forgery in admin users](https://junglewise.ai/threats/cve-2026-101093-cotonti-through-1-0-0-contains-a-cross-site-request-forgery) (medium, CVSS 5.4, published 28 Sep 2026) - [CVE-2026-100524: Cotonti cross-site request forgery in extensions manager](https://junglewise.ai/threats/cve-2026-100524-cotonti-through-1-0-0-contains-a-cross-site-request-forgery) (medium, CVSS 5.4, published 26 Sep 2026) - [CVE-2026-100523: Cotonti open redirect in message.php](https://junglewise.ai/threats/cve-2026-100523-cotonti-through-1-0-0-contains-an-open-redirect-vulnerability-in) (medium, CVSS 6.1, published 26 Sep 2026) - [CVE-2026-100522: Cotonti reflected cross-site scripting in message.php](https://junglewise.ai/threats/cve-2026-100522-cotonti-through-1-0-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 6.1, published 26 Sep 2026) - [CVE-2026-100521: Cotonti reflected cross-site scripting in search plugin](https://junglewise.ai/threats/cve-2026-100521-cotonti-through-1-0-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 6.1, published 26 Sep 2026) - [CVE-2026-93873: Cotonti contact plugin CSRF token validation bypass](https://junglewise.ai/threats/cve-2026-93873-cotonti-through-1-0-0-fails-to-validate-anti-csrf-tokens-in-the) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-93872: Cotonti insecure unserialize in comments plugin](https://junglewise.ai/threats/cve-2026-93872-cotonti-1-0-0-passes-the-base64-decoded-cb-parameter-to) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-93871: Cotonti unvalidated redirect in page body](https://junglewise.ai/threats/cve-2026-93871-cotonti-through-1-0-0-fails-to-validate-redirect-destinations-in) (medium, CVSS 5.4, published 18 Sep 2026) - [CVE-2026-93870: Cotonti ratings plugin CSRF token validation bypass](https://junglewise.ai/threats/cve-2026-93870-cotonti-through-1-0-0-fails-to-validate-anti-csrf-tokens-in-the) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-93869: Cotonti open redirect in cot_url_check()](https://junglewise.ai/threats/cve-2026-93869-cotonti-through-1-0-0-contains-an-open-redirect-vulnerability-in) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-93868: Cotonti predictable password recovery token in users.passrecover.php](https://junglewise.ai/threats/cve-2026-93868-cotonti-through-1-0-0-derives-password-recovery-validation-tokens) (high, CVSS 8.1, published 18 Sep 2026) - [CVE-2026-55746: Cotonti stored XSS in Personal File Storage module](https://junglewise.ai/threats/cve-2026-55746-cotonti-stored-xss-in-personal-file-storage-module) (high, CVSS 7.6, published 18 Jun 2026) - [CVE-2026-55745: Cotonti CSRF in Personal File Storage module](https://junglewise.ai/threats/cve-2026-55745-cotonti-csrf-in-personal-file-storage-module) (medium, CVSS 5.4, published 18 Jun 2026) - [CVE-2026-55744: Cotonti CSRF in Personal File Storage module](https://junglewise.ai/threats/cve-2026-55744-cotonti-csrf-in-personal-file-storage-module) (high, CVSS 8.1, published 18 Jun 2026) - [CVE-2026-55742: Cotonti CSRF in administration rights handler](https://junglewise.ai/threats/cve-2026-55742-cotonti-csrf-in-administration-rights-handler) (critical, CVSS 9.6, published 18 Jun 2026) - [CVE-2026-55741: Cotonti CSRF in administration configuration handler](https://junglewise.ai/threats/cve-2026-55741-cotonti-csrf-in-administration-configuration-handler) (high, CVSS 8.8, published 18 Jun 2026) ## Most severe Cotonti vulnerabilities - [CVE-2026-55742: Cotonti CSRF in administration rights handler](https://junglewise.ai/threats/cve-2026-55742-cotonti-csrf-in-administration-rights-handler) (critical, CVSS 9.6, published 18 Jun 2026) - [CVE-2026-55741: Cotonti CSRF in administration configuration handler](https://junglewise.ai/threats/cve-2026-55741-cotonti-csrf-in-administration-configuration-handler) (high, CVSS 8.8, published 18 Jun 2026) - [CVE-2026-93868: Cotonti predictable password recovery token in users.passrecover.php](https://junglewise.ai/threats/cve-2026-93868-cotonti-through-1-0-0-derives-password-recovery-validation-tokens) (high, CVSS 8.1, published 18 Sep 2026) - [CVE-2026-55744: Cotonti CSRF in Personal File Storage module](https://junglewise.ai/threats/cve-2026-55744-cotonti-csrf-in-personal-file-storage-module) (high, CVSS 8.1, published 18 Jun 2026) - [CVE-2026-55746: Cotonti stored XSS in Personal File Storage module](https://junglewise.ai/threats/cve-2026-55746-cotonti-stored-xss-in-personal-file-storage-module) (high, CVSS 7.6, published 18 Jun 2026) - [CVE-2026-93872: Cotonti insecure unserialize in comments plugin](https://junglewise.ai/threats/cve-2026-93872-cotonti-1-0-0-passes-the-base64-decoded-cb-parameter-to) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-93869: Cotonti open redirect in cot_url_check()](https://junglewise.ai/threats/cve-2026-93869-cotonti-through-1-0-0-contains-an-open-redirect-vulnerability-in) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-100523: Cotonti open redirect in message.php](https://junglewise.ai/threats/cve-2026-100523-cotonti-through-1-0-0-contains-an-open-redirect-vulnerability-in) (medium, CVSS 6.1, published 26 Sep 2026) - [CVE-2026-100522: Cotonti reflected cross-site scripting in message.php](https://junglewise.ai/threats/cve-2026-100522-cotonti-through-1-0-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 6.1, published 26 Sep 2026) - [CVE-2026-100521: Cotonti reflected cross-site scripting in search plugin](https://junglewise.ai/threats/cve-2026-100521-cotonti-through-1-0-0-contains-a-reflected-cross-site-scripting) (medium, CVSS 6.1, published 26 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 91% on the four before (11). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 6 | 0 | 0 | | 21 Sep 2026 | 4 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cotonti vulnerabilities", https://junglewise.ai/threats/technologies/cotonti, 11 November 2026.