Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

CVE-2024-36058

CVE-2024-36058 - Koha Library Software CVE ID: CVE-2024-36058 Product: Koha Library Software Vulnerability Type: Time-Based Blind SQL Injection CWE-89 CVSS Score: 9.8 Critical Affected Versions: Below 23.05.10 Credits: Karolis Narvilas Description Koha is an open-source integrated library system....

CVE-2024-36057

CVE-2024-36057 - Koha Library Software CVE ID: CVE-2024-36057 Product: Koha Library Software Vulnerability Type: OS Command Injection CWE-78 CVSS Score: 9.8 Critical Affected Versions: Below 23.05.10 Credits: Karolis Narvilas Description Koha is an open-source integrated library system. A command...

CVE-2026-31844

Koha CVE-2026-31844: Authenticated SQL Injection Overview This repository contains a responsible vulnerability POC for CVE-2026-31844 , a high severity authenticated SQL injection vulnerability in the Koha Library Management System. The vulnerability exists in the GetDistinctValues function in...

CVE-2025-22954

Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha before version 24.11.02. The vulnerability exists in the GetLateOrMissingIssues function in...

CVE-2026-105106

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

CVE-2026-105107

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

EUVD-2026-100898

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107

The Koha library system is vulnerable to SQL injection within the reports/cat_issues_top.pl script (specifically the sub calculate function). The root cause is the direct concatenation of user-controlled Criteria , Filter , and Limit request parameters into dynamic SQL queries without adequate va...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105106

The Koha library is vulnerable to OS command injection within the Task Scheduler deletion path. The tools/scheduler.pl handler accepts a jobid parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without proper validation. Specifically, Schedule::At::remove substitutes the un...

CVE-2026-105106 Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

EUVD-2026-100897

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::removeatjob without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

PT-2026-113714

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat issues top.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-19780

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780

CVE-2026-19780 is a remote code execution vulnerability in Koha , a web service listening on TCP port 8081 by default. The flaw stems from improper validation of a user-supplied string before it is passed to the eval function, allowing an authenticated remote attacker to execute arbitrary code in...