EUVD-2026-52674

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

CVE-2026-70370 Koha - SQL Injection in reports/catalogue_stats.pl

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...

CVE-2026-70369 Koha - SQL Injection in reports/acquisitions_stats.pl

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

Koha security vulnerabilities

Koha is a system used by the Koha organization for automated library management building. A security vulnerability exists in Koha version 21.11 and earlier, which stems from the supplierid parameter not being properly cleaned up, and could lead to SQL injection...

Koha security vulnerabilities

Koha is a system used by the Koha organization for automated library management building. A security vulnerability exists in Koha version 23.05 and earlier. A remote attacker can exploit the vulnerability to execute arbitrary code via the additonal-contents.pl component...

Library Management System Security Vulnerability

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability in Koha Library Management System version 23.05.05 and earlier, which originates in the /members/moremember.pl and...

CVE-2022-0495

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01...