CVE-2025-24025

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-240265.3iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that CVE-2025-240276.2ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up CVE-2025-240289.6Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vul CVE-2025-240295.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widge CVE-2025-24037.5A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and S CVE-2025-240307.1Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access CVE-2025-240315.1PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 modul CVE-2025-240329.2PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to CVE-2025-240337.5@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` fun CVE-2025-240343.2Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and CVE-2025-240358.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a CVE-2025-240367.0Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability