CVE-2025-29746

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/unklerunkle/73e2ab58d1a5b9129be5de55765ea4feExploit, Third Party Advisory
https://github.com/benjaminjonard/koillection/issues/1329Exploit, Issue Tracking, Third Party Advisory
https://github.com/benjaminjonard/koillection/issues/1329Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-29755.4A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file S CVE-2025-297568.3SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devic CVE-2025-297579.4An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid CVE-2025-29765.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the componen CVE-2025-297664.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on arti CVE-2025-297684.4Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impac CVE-2025-297695.5libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence CVE-2025-29775.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown func CVE-2025-297706.5vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vL CVE-2025-297715.3HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used CVE-2025-297726.1OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcatego CVE-2025-297737.8Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or custome