THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-55746 (HIGH 7.6) — Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so a

[NVD] CVE-2026-55746 (HIGH 7.6) — Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so a

lownvdPublished 2026-06-18

CVE-2026-55746 CVSS: 7.6 HIGH Published: 2026-06-18T08:16:34.453

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a fo

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-55746cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-55746