CVE-2026-100522CWE-79cross-site-scripting

CVE-2026-100522

Medium · published September 26, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-26T05:17Z
References (5)
https://github.com/Cotonti/Cotonti · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php · [email protected]https://github.com/Cotonti/Cotonti/issues/1907 · [email protected]https://github.com/Cotonti/Cotonti/pull/1908 · [email protected]https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 00:59Z
    Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
    cvelistv5