CVE-2026-100522

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description A reflected cross-site scripting issue exists in the 'message.php' endpoint. The lng parameter is not properly escaped before being displayed in the confirmation dialog, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser sessions of victims by using malicious links.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the lng parameter in the 'message.php' endpoint until the issue is resolved.