EUVD-2026-52674

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

CVE-2026-70371 Koha: SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

CVE-2026-70370 Koha: SQL Injection in reports/catalogue_stats.pl

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation. When Line contains itemcallnumber and t...

CVE-2026-70369 Koha: SQL Injection in reports/acquisitions_stats.pl

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

Koha 安全漏洞

Koha is a system used by the Koha organization for automated library management building. A security vulnerability exists in Koha version 21.11 and earlier, which stems from the supplierid parameter not being properly cleaned up, and could lead to SQL injection...

Koha 安全漏洞

Koha is a system used by the Koha organization for automated library management building. A security vulnerability exists in Koha version 23.05 and earlier. A remote attacker can exploit the vulnerability to execute arbitrary code via the additonal-contents.pl component...

Library Management System Security Vulnerability

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability in Koha Library Management System version 23.05.05 and earlier, which originates in the /members/moremember.pl and...

CVE-2022-0495

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01...