Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

CVE-2024-36058

CVE-2024-36058 — Koha Library Software ID CVE: CVE-2024-36058 Producto: Koha Library Software Tipo de Vulnerabilidad: Inyección SQL Ciega Basada en Tiempo CWE-89 Puntuación CVSS: 8.1 Alta Autenticada Versiones Afectadas: Inferiores a 22.05.22 Créditos: Karolis Narvilas Descripción Koha es un...

CVE-2024-36057

CVE-2024-36057 — Koha Library Software ID CVE: CVE-2024-36057 Producto: Koha Library Software Tipo de Vulnerabilidad: Inyección de Comandos del Sistema Operativo CWE-78 Puntuación CVSS: 8.7 Alta Autenticado Versiones Afectadas: Inferiores a 22.05.22 Créditos: Karolis Narvilas Descripción Koha es ...

CVE-2026-31844

Koha CVE-2026-31844: Authenticated SQL Injection Overview This repository contains a responsible vulnerability POC for CVE-2026-31844 , a high severity authenticated SQL injection vulnerability in the Koha Library Management System. The vulnerability exists in the GetDistinctValues function in...

CVE-2025-22954

Koha CVE-2025-22954: Inyección SQL en lateissues-export.pl Resumen Este repositorio contiene una prueba de concepto para CVE-2025-22954, una vulnerabilidad de inyección SQL de criticidad alta CVSS 10.0 en Koha anterior a la versión 24.11.02. La vulnerabilidad existe en la función...

CVE-2026-19780

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

EUVD-2026-78820

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780

CVE-2026-19780 is a remote code execution vulnerability in Koha , a web service listening on TCP port 8081 by default. The flaw stems from improper validation of a user-supplied string before it is passed to the eval function, allowing an authenticated remote attacker to execute arbitrary code in...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780: Improper Neutralization of Directives in Dynamically Evaluated Code

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

PT-2026-88528

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An issue exists in the web service that listens on TCP port 8081 by default, where a lack of proper validation of a user-supplied string before it is passed to the eval function allows...

Koha Eval Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper...

Exploit for CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-3...

Exploit for CVE-2024-36057

CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-3...

CVE-2026-41921

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-41921

Koha (versions before 25.05.13, 25.11.07, and 26.05.02) stores unsanitized input from fields like title, author, isbn, publishercode, place, collectiontitle, itemtype, and note in the purchase suggestion handler, rendering it in the suggestion list template and executing injected scripts in other...

EUVD-2026-62183

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...