What’s Vulnerable › Vulnerabilities

CVE-2021-47808: Cotonti Siena 0.9.19 - 'maintitle' Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-16 · updated 2026-06-17
• Weakness: CWE-79

Description

Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.

Affected products

• cotonti.com Cotonti Siena: 0.9.19

References

• https://cotonti.com
• https://www.cotonti.com/download/
• https://www.exploit-db.com/exploits/50016
• https://www.vulncheck.com/advisories/cotonti-siena-maintitle-stored-cross-site-scripting
• https://www.exploit-db.com/exploits/50016

Get alerted when CVE-2021-47808 or the next vulnerability affects your stack