CyberRota Analysis
AI-GeneratedCotonti Siena versions 0.9.26 and earlier are vulnerable to a stored cross-site scripting (XSS) flaw that allows authenticated users with PFS access to inject malicious scripts via the ntitle parameter. This vulnerability can lead to the execution of arbitrary scripts in the browsers of users viewing the affected folder listings, potentially compromising sensitive information or user sessions. Organizations using this software, particularly those with user-generated content features, should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.