CVE-2026-6428

🗓️ 13 Jun 2026 16:34:10Reported by TuranSecType

cve🔗 web.nvd.nist.gov👁 25 Views🌐 WEB

Authenticated staff can exploit SQL injection in Koha reports via Filter in catalogue_out.pl, leaking data.

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2026-6428	13 Jun 202616:34	–	cvelist
EUVD	EUVD-2026-36652	13 Jun 202616:34	–	euvd
NVD	CVE-2026-6428	13 Jun 202617:16	–	nvd
Positive Technologies	PT-2026-49097	13 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-6428	13 Jun 202616:34	–	vulnrichment

[
  {
    "vendor": "Koha Community",
    "product": "Koha",
    "collectionURL": "https://koha-community.org/",
    "repo": "https://gitlab.com/koha-community/Koha",
    "programFiles": [
      "reports/catalogue_out.pl"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "22.11.38",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "23.05.00",
        "lessThanOrEqual": "23.11.15",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "24.05.00",
        "lessThan": "24.11.16",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.05.00",
        "lessThan": "25.05.11",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "25.11.00",
        "lessThan": "25.11.05",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "26.05.00",
        "lessThan": "26.05.01",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
bugs	www.bugs.koha-community.org/bugzilla3/attachment.cgi
koha-community	www.koha-community.org/security-releases/
bugs	www.bugs.koha-community.org/bugzilla3/show_bug.cgi

Parameter	Position	Path	Description	CWE
Filter	query param	/cgi-bin/koha/reports/catalogue_out.pl	SQL injection via unbound Filter parameter in reports/catalogue_out.pl allowing error-based injections and read access to sensitive data.	CWE-89

17 Jun 2026 11:00Current

6Medium risk

Vulners AI Score6

CVSS 46.1

CVSS 27.5

CVSS 3.17.6

EPSS0.00244

SSVC

CWE-89