---
id: CVE-2026-100522
title: >-
  Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability
  in message.php where the lng parameter is not properly escaped before output
  in the confirmation dialog
summary: >-
  Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability
  in message.php where the lng parameter is not properly escaped before output
  in the confirmation dialog. Unauthenticated attackers can craft malicious
  links wi…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Cotonti
product: Cotonti
affected:
  - Cotonti <= 1.0.0
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T01:17:00.823'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100522'
references:
  - url: 'https://github.com/Cotonti/Cotonti'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/issues/1907'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/pull/1908'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T01:24:36.887Z'
---

## Overview

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.