rootpwn

critical · CVSS v3 8.1 · CVSS v4 9.2

CVE-2026-93868

Cotonti CMS up to version 1.0.0 generates predictable password‑recovery tokens using md5(microtime()), allowing attackers to brute‑force res

Overview

Cotonti CMS up to version 1.0.0 generates predictable password‑recovery tokens using md5(microtime()), allowing attackers to brute‑force reset any account password, including administrators. The flaw is exploitable without authentication and can be performed within a narrow time window. It is critical due to the ease of token prediction and lack of rate limiting.

Description

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.

Impact

Confidentiality: attackers can gain unauthorized access to any user account. Integrity: password changes alter account state without authorization. Availability: repeated reset attempts may cause service disruption. Administrators and all users are impacted.

Remediation

Upgrade to the latest Cotonti release where token generation uses a cryptographically secure random value. If an upgrade is not possible, disable the password‑recovery feature or implement rate limiting and IP blocking on the /passrecover endpoint. Monitor for abnormal password‑reset activity and enforce strong password policies.

Risk context

Severity is critical with CVSS 8.1/9.2, indicating high risk. No EPSS data is available, but the vulnerability is immediately exploitable. Defenders should act promptly.

Affected products

  • Cotonti CMS <=1.0.0

Scores

Severity
critical
CVSS v2
7.6
CVSS v3
8.1
CVSS v4
9.2
EPSS
—

Cotonti password-recovery token-prediction critical unauthenticated CMS authentication-bypass

← All CVEs

Related CVEs

critical

CVE-2026-93922

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

View analysis

critical

CVE-2026-93923

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

View analysis

critical

CVE-2026-93031

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

View analysis

critical

CVE-2026-93839

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

View analysis