CVE-2025-29746

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components...

CVE-2025-29746

The Koillection self-hosted collection management service (version 1.6.10 ) is vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is insufficient input sanitization within the collection , Wishlist , and album components, which allows a remote attacker to inject malicious scripts and...

Koillection security vulnerabilities

Koillection is a self-hosted service by Benjamin Jonard Personal Developer that allows users to manage any type of collection. A security vulnerability exists in Koillection version 1.6.10, which stems from cross-site scripting and could lead to elevation of privilege...