CVE-2025-34157
Improper input validation in Coollabs Coolify
CVSS score
9.0
EPSS probability
%0.5
Risk score
0.0
Published
1 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
A stored XSS in the project delete flow allows execution of attacker-controlled JavaScript in an administrator’s browser when the admin attempts to delete a project created by a low-privileged user. This can lead to takeover of the Coolify instance (cookies, API tokens, WebSocket/terminal actions) (★0)
Makefile Go / Python
Similar Vulnerabilities
8.8
CVE-2025-34161Improper input validation in Coollabs Coolify
Patch status unknown Public Exploits:1EPSS %3
8.8
CVE-2025-64424Command injection in Coollabs Coolify
Patch status unknown Public Exploits:2EPSS %2
8.8
CVE-2025-59157OS command injection in Coollabs Coolify
Patch status unknown Public Exploits:1EPSS %2
8.8
CVE-2025-59156OS command injection in Coollabs Coolify
Patch status unknown Public Exploits:1EPSS %1
8.8
CVE-2025-34159Improper input validation in Coollabs Coolify
Patch status unknown Public Exploits:1EPSS %1
8.8
CVE-2025-64419Command injection in Coollabs Coolify
Patch verified Public Exploits:1EPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-34157"