Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coollabsio — Vulnerabilities & Security Advisories 75

Browse all 75 CVE security advisories affecting coollabsio. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Coollabs.io operates as a comprehensive platform for managing and monetizing content creator communities, primarily through its proprietary software, All in One SEO. This infrastructure handles sensitive user data, payment processing, and extensive content management workflows, making it a significant target for automated scanning and exploitation. Historical vulnerability records indicate a prevalence of cross-site scripting (XSS) and SQL injection flaws, stemming from complex input validation requirements across its diverse modules. Additionally, the platform has faced instances of remote code execution and privilege escalation vulnerabilities, often linked to outdated dependencies or misconfigured server environments. While no catastrophic data breaches have been publicly confirmed, the accumulation of twenty-five Common Vulnerabilities and Exposures highlights ongoing challenges in maintaining rigorous security hygiene. These findings underscore the critical need for continuous patch management and secure coding practices within large-scale community management ecosystems to mitigate risks associated with high-traffic web applications.

Top products by coollabsio: coolify
CVE ID Title CVSS Severity Published
CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication — Coolify CWE-306 7.3 High 2026-09-27
CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization — Coolify CWE-862 7.3 High 2026-09-27
CVE-2026-86117 Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching — coolify CWE-287 8.1 High 2026-09-05
CVE-2026-84694 Coolify before 4.2.0 Remote Code Execution via Environment Variable Key — coolify CWE-78 8.8 High 2026-09-02
CVE-2026-15507 coollabsio Coolify Policy Policies authorization — Coolify CWE-862 6.3 Medium 2026-07-12
CVE-2026-59734 Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution — coolify CWE-78 8.8 High 2026-07-09
CVE-2026-42201 Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands — coolify CWE-78 3.3 Low 2026-07-07
CVE-2026-34158 Coolify: Command injection via single-quote breakout in Docker Compose custom commands — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL — coolify CWE-918 4.3 Medium 2026-07-07
CVE-2026-34037 Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() — coolify CWE-639 9.9 Critical 2026-07-07
CVE-2026-34048 Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers — coolify CWE-285 9.9 Critical 2026-07-07
CVE-2026-34057 Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-42143 Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection() — coolify CWE-918 4.9 Medium 2026-07-07
CVE-2026-34044 Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) — coolify CWE-639 7.7 High 2026-07-07
CVE-2026-34152 Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-34149 Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs — coolify CWE-78 3.3 Low 2026-07-07
CVE-2026-34171 Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value — coolify CWE-352 8.0 High 2026-07-07
CVE-2026-34034 Coolify: Host RCE via Sentinel token injection — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-34168 Coolify: Command injection via unsanitized persistent storage name in docker volume commands — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-42145 Coolify: File Upload Without Type or Size Validation in Database Backup Restore — coolify CWE-434 3.1 Low 2026-07-07
CVE-2026-34198 Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing — coolify CWE-640 5.3 Medium 2026-07-07
CVE-2026-34058 Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-34035 Coolify: Host RCE via Log Drain secret/env command injection — coolify CWE-78 8.8 High 2026-07-07
CVE-2026-34047 Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution — coolify CWE-863 9.9 Critical 2026-07-07
CVE-2026-42172 Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access — coolify CWE-613 3.1 Low 2026-07-07
CVE-2026-42200 Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE — coolify CWE-22 8.8 High 2026-07-07
CVE-2026-42153 Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container — coolify CWE-78 8.8 High 2026-07-06
CVE-2026-34167 Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor — coolify CWE-639 5.0 Medium 2026-07-06
CVE-2026-34049 Coolify: Command Injection via unsanitized MongoDB collection names in database backup — coolify CWE-78 3.3 Low 2026-07-06

This page lists every published CVE security advisory associated with coollabsio. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.