CVE-2026-93869: falha de média gravidade em Cotonti
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Cotonti · CotontiCVEs relacionadas — Cotonti
No mesmo produto, das mais perigosas para as menos.
CVE-2026-91939CRITICALCotonti 1.0.0 Comments Plugin PHP Object Injection via ci ParameterEPSS 1.0%CVE-2026-93868CRITICALCotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNGEPSS 0.7%CVE-2026-93872HIGHCotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb ParameterEPSS 0.7%CVE-2026-71294HIGHCotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit ActionsEPSS 0.4%CVE-2026-93871MEDIUMCotonti through 1.0.0 Stored Open Redirect via Page redir: PrefixEPSS 0.3%CVE-2026-58143HIGHCotonti Siena 0.9.26 CSRF via admin.php Config Update EndpointEPSS 0.2%
Referências
https://github.com/Cotonti/Cotontihttps://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/ratings/ratings.ajax.phphttps://github.com/Cotonti/Cotonti/blob/1.0.0/system/functions.phphttps://github.com/Cotonti/Cotonti/issues/1891https://github.com/Cotonti/Cotonti/pull/1899https://www.vulncheck.com/advisories/cotonti-through-1.0.0-open-redirect-via-unanchored-cot-url-check-regex