medium6.1
CVE-2025-29746
Koillection Cross Site Scripting vulnerability
Impact
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | koillection/koillection | < 1.6.12 | 1.6.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Benjaminjonard | Koillection | Version 1.6.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/unklerunkle/73e2ab58d1a5b9129be5de55765ea4fe
- https://github.com/benjaminjonard/koillection/issues/1329
- https://github.com/advisories/GHSA-fxvx-gfmr-5xfj
- https://nvd.nist.gov/vuln/detail/CVE-2025-29746
- https://github.com/benjaminjonard/koillection/releases/tag/1.6.11
- https://github.com/benjaminjonard/koillection/releases/tag/1.6.12