CVE-2026-72610

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72610

Koha CVE-2026-72610 is a stored SQL injection affecting Koha releases up to 26.05.01 where an authenticated staff member with the borrowers => edit_borrowers permission can store a SQL payload in a patron lang field. The payload concatenates into a subquery in Koha::AdditionalContents->sear...

CVE-2026-72610 Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

EUVD-2026-56131

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...