CVE-2025-9747: koillection before 1.7.0 (exclusive); +1 more affected products

Affected technology

koillection · before 1.7.0 (exclusive)
benjaminjonard

Koillection · 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18
Vendor not specified by the source

Description’s affected range: up to 1.6.18

Component: Not specified by the source
Function: of
File: assets/controllers/csrf_protection_controller.js

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.