CVE-2024-36057

CVE-2024-36057 — Koha 图书馆软件 CVE ID： CVE-2024-36057 产品： Koha 图书馆软件 漏洞类型： 操作系统命令注入 CWE-78 CVSS 评分： 8.7（高危）需认证 受影响版本： 低于 22.05.22 致谢： Karolis Narvilas 描述 Koha 是一个开源集成图书馆系统。在 tools/upload-cover-image.pl 的封面图片上传功能中存在命令注入漏洞。该应用程序使用 qx/unzip $filename -d $dirname/ 来解压上传的 ZIP 压缩包，但未对文件名参数进行清理。...

CVE-2024-36058

CVE-2024-36058 — Koha 图书馆软件 CVE ID: CVE-2024-36058 产品: Koha 图书馆软件 漏洞类型: 基于时间的盲注 SQL 注入 CWE-89 CVSS 评分: 8.1（高危）需认证 受影响版本: 低于 22.05.22 致谢: Karolis Narvilas 描述 Koha 是一个开源的综合图书馆系统。在 opac/opac-sendbasket.pl 的“发送购物篮”功能中存在一个基于时间的盲注 SQL 注入漏洞。biblist 参数未经净化便传入 SQL 查询，允许攻击者注入任意 SQL 载荷，导致服务器响应出现可测量的延迟。...

Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

CVE-2026-31844

Koha CVE-2026-31844：已认证 SQL 注入 概述 本仓库包含针对 CVE-2026-31844 的负责任漏洞 PoC，这是 Koha 图书馆管理系统中一个高严重性的已认证 SQL 注入漏洞。 该漏洞存在于 C4/Search.pm 中的 GetDistinctValues 函数中，该函数由 /cgi-bin/koha/suggestion/suggestion.pl 脚本调用。攻击者可通过 displayby 参数利用此漏洞。 Koha Bug： 41593 修复版本： 26.05.00、25.11.01、25.05.07、24.11.12 漏洞详情...

CVE-2025-22954

Koha CVE-2025-22954：lateissues-export.pl 中的 SQL 注入漏洞 概述 本仓库包含 CVE-2025-22954 的概念验证，这是一个严重影响级别（CVSS 10.0）的 SQL 注入漏洞，影响 24.11.02 之前的 Koha 版本。该漏洞存在于 C4/Serials.pm 的 GetLateOrMissingIssues 函数中，该函数由 /serials/lateissues-export.pl 脚本调用。漏洞可通过 supplierid 或 serialid 参数进行利用。 CVE ID| CVE-2025-22954 ---|---...

CVE-2026-41921

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-41921

Koha (versions before 25.05.13, 25.11.07, and 26.05.02) stores unsanitized input from fields like title, author, isbn, publishercode, place, collectiontitle, itemtype, and note in the purchase suggestion handler, rendering it in the suggestion list template and executing injected scripts in other...

EUVD-2026-62183

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

PT-2026-77337

Name of the Vulnerable Software and Affected Versions Koha versions prior to 26.05.02 Koha versions prior to 25.11.07 Koha versions prior to 25.05.13 Description A stored cross-site scripting issue exists in the purchase suggestion handler. Authenticated staff users can inject malicious scripts b...

CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

CVE-2026-72610

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72608

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-72607

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...

EUVD-2026-56131

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72610

Koha CVE-2026-72610 is a stored SQL injection affecting Koha releases up to 26.05.01 where an authenticated staff member with the borrowers => edit_borrowers permission can store a SQL payload in a patron lang field. The payload concatenates into a subquery in Koha::AdditionalContents->sear...

CVE-2026-72610 Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72610

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...