CVE-2026-100522

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100522
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100522.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100522
Published
2026-09-26T00:59:23Z
Modified
2026-09-27T03:47:23Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
Details

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100522.json"
}
References

Affected packages

Git / github.com/cotonti/cotonti

Affected ranges

Type
GIT
Repo
https://github.com/cotonti/cotonti
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d554e939a315e7f7f18fba3ca1132b80c6a1adb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.9.12
0.9.12.1
0.9.13
0.9.14
0.9.15
0.9.16
0.9.16.1
0.9.16.2
0.9.17
0.9.18
0.9.18.1
0.9.19
0.9.19-RC.1
0.9.19-rc1
0.9.20
0.9.20.1
0.9.21
0.9.22
0.9.23
0.9.24
0.9.24.1
0.9.24.2
0.9.25
cotonti-0.*
cotonti-0.9.10
cotonti-0.9.11
cotonti-0.9.11.1
cotonti-0.9.3
cotonti-0.9.6
cotonti-0.9.7
cotonti-0.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100522.json"