5 matches found
CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...
CVE-2026-72608
Koha CVE-2026-72608 is a stored SQL injection affecting Koha versions up to 26.05.01 (and 24.11.17, 25.05.12, 25.11.06). Authenticated staff with the label_creator permission can trigger arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored in the layout X...
CVE-2016-10758
PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the imagename parameter...
