Product
3 published CVES affecting benjaminjonard/koillection, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from publi...
A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The exploit has been disclosed to...
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.