Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-29746
CVE-2025-29746:
PHP vulnerability analysis and mitigation
Overview
Cross Site Scripting (XSS) vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components. The vulnerability was discovered in March 2025 and publicly disclosed on May 1, 2025 (GitHub Issue, GitHub Gist). The issue affects multiple components of the application and has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) (NVD).
Technical details
The vulnerability encompasses both Stored and Reflected XSS variants affecting multiple locations within the application. The vulnerable components include the Collections section (stored XSS in text field during creation/editing), Wishlists section (reflected XSS when adding new wishlists), and Albums section (reflected XSS when adding new albums). The issue stems from improper input validation and output encoding of user-supplied data (GitHub Issue). The vulnerability has been classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).
Impact
While the impact is partially mitigated by the presence of HTTPOnly cookies preventing session hijacking, the vulnerability could still be exploited for phishing attacks through malicious redirections using window.location payloads. The vulnerability potentially affects data integrity and could lead to user misdirection to malicious sites (GitHub Issue).
Mitigation and workarounds
The vulnerability has been fixed in version 1.6.11. The recommended mitigation strategy involves filtering input on arrival and encoding data on output. For unpatched systems, there are no documented workarounds (GitHub Gist).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management