CVE-2026-100522: Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can craft a malicious link containing a script payload in the lng parameter. A victim must open that link for the payload to execute in the victim's browser session.
Which component and input should defenders investigate?
Investigate requests to message.php, specifically the lng parameter. The vulnerable behavior occurs when that parameter is reflected into a confirmation dialog without proper escaping.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary JavaScript execution in the victim's browser session. The reported impact includes confidentiality and integrity effects, while availability is not affected.