CVE-2024-24336

A multiple Cross-site scripting XSS vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and...

CVE-2023-44962

File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component...

CVE-2023-5025

A vulnerability was found in KOHA up to 23.05.03. It has been declared as problematic. This vulnerability affects unknown code of the file /cgi-bin/koha/catalogue/search.pl of the component MARC. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has...

CVE-2018-25101

A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2" leads to cross site scripting. The...

CVE-2014-9446

Multiple cross-site scripting XSS vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sortby parameter to the 1 opac parameter in opac-search.pl or 2 intranet parameter in catalogue/search.pl...

Exploit for CVE-2025-22954

Koha CVE-2025-22954: SQL Injection in lateissues-export.pl...

Koha SQL Injection

Koha versions prior to 24.11.02 suffer from a remote SQL injection vulnerability in C4/Serials.pm. Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha...

CVE-2025-30076

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

CVE-2025-30076

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

CVE-2025-30076

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

CVE-2025-30076: Improper Neutralization of Special Elements used in an OS Command

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

Koha 操作系统命令注入漏洞

Koha is a Koha organization's system for automated library administration building. A security vulnerability exists in Koha versions prior to 24.11.02, which stems from an administrator being able to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

PT-2025-11376

Name of the Vulnerable Software and Affected Versions: Koha versions prior to 24.11.02 Description: The issue allows admins to execute arbitrary commands via shell metacharacters in the report parameter of the tools/scheduler.pl script. Recommendations: For versions prior to 24.11.02, update to...

CVE-2025-30076

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

CVE-2025-30076

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...

CVE-2025-30076

Koha vulnerability CVE-2025-30076: affects Koha prior to 24.11.02, where admins can execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. Root cause is unvalidated shell input allowing command execution. Impact is authenticated admin access leading to pot...

CVE-2025-22954

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...

CVE-2025-22954

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...

CVE-2025-22954

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...

PT-2025-11081

Name of the Vulnerable Software and Affected Versions Koha versions prior to 24.11.02 Description The issue allows SQL injection in /serials/lateissues-export.pl via the supplierid or serialid parameter. This could let attackers access sensitive data, tamper with records, or wipe out databases...