Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2025-44115: Cotonti Siena: Malicious Code Can Be Injected into Admin Panel
CVE-2025-44115 · published 1 year ago
Summary
A security issue has been found in Cotonti Siena version 0.9.25. If an attacker can manipulate the title field in the admin panel, they can inject malicious code into the website, potentially allowing them to take control of the site or steal sensitive information. To protect your site, update to the latest version of Cotonti Siena or apply a patch if available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cotonti | cotonti_siena |
0.9.25 cpe:2.3:a:cotonti:cotonti_siena:0.9.25:*:*:*:*:*:*:* |
Original advisory text
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-...
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
References
- https://gist.github.com/yA0-Z/9666b1a333607381ab8dfcc137f2b65c URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/44xxx/CVE-2025-44115... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-44115 Vendor Advisory
- https://github.com/Cotonti/Cotonti/issues/1650 Third Party Advisory
- https://github.com/Cotonti/Cotonti/issues/1834 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta