CVE-2025-29746

The Koillection self-hosted collection management service (version 1.6.10 ) is vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is insufficient input sanitization within the collection , Wishlist , and album components, which allows a remote attacker to inject malicious scripts and...

CVE-2025-9747

Koillection vulnerability CVE-2025-9747 affects versions up to 1.6.18 due to an unknown function in assets/controllers/csrf_protection_controller.js, enabling cross-site request forgery. The issue can be exploited remotely, and the exploit has been disclosed publicly. A fix is available in versio...