Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a "ci" POST parameter obtained via "cot_import('ci', 'P', 'TXT')" (trim-only sanitization) is passed to "unserialize(base64_decode($ci))" with no "allowed_classes" restriction, reachable by any member with write access to comments (the default "Auth_members => 'RW'" setting in plugins/comments/comments.setup.php). In plugins/comments/controllers/actions/EditAction.php, a "cb" parameter is similarly deserialized via "unserialize(base64_decode($this->comeback))" in prepareComeBack(), reachable by any member editing their own comment. Because unserialize() is called without allowed_classes, an attacker can construct a serialized PHP object of any class loaded by Cotonti (a PHP Object Injection primitive). This was demonstrated in practice using Cotonti's own MySQL_cache class: a crafted serialized MySQL_cache object, once deserialized and later garbage-collected, triggers its __destruct()->flush() chain, causing an attacker-controlled INSERT INTO cot_cache with attacker-chosen row values — confirming genuine POP-chain exploitation, with further impact (including potential RCE) contingent on other gadget chains available in a given Cotonti installation's loaded classes. A third sink in DeleteAction.php contains the identical unserialize() pattern but is gated behind an admin-only authorization check and is not reachable by ordinary members.