https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:06:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-58143 <p><strong>Affected:</strong> Cotonti</p> <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> <p><strong>Affected:</strong> Cotonti</p> <p>Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application&#39;s CSRF validation function. Attackers can disable the PFS module&#39;s file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.</p> https://cve.radiocsirt.org/vuln/cve-2026-58143