448 matches found
Koha SQL Injection
Koha versions prior to 24.11.02 suffer from a remote SQL injection vulnerability in C4/Serials.pm. Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha...
CVE-2025-30076
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
CVE-2025-30076
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
Koha 操作系统命令注入漏洞
Koha is a Koha organization's system for automated library administration building. A security vulnerability exists in Koha versions prior to 24.11.02, which stems from an administrator being able to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
CVE-2025-30076
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
CVE-2025-30076
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
CVE-2025-30076: Improper Neutralization of Special Elements used in an OS Command
Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter...
CVE-2025-30076
Koha vulnerability CVE-2025-30076: affects Koha prior to 24.11.02, where admins can execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. Root cause is unvalidated shell input allowing command execution. Impact is authenticated admin access leading to pot...
CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
CVE-2025-22954
Koha vulnerability CVE-2025-22954 affects Koha before 24.11.02. The issue is in GetLateOrMissingIssues within C4/Serials.pm, triggered by the lateissues-export.pl script via supplierid or serialid parameters, enabling SQL injection. The exploitation path is documented in PoC materials (e.g., a Gi...
Koha 安全漏洞
Koha is a system used by the Koha organization for automated library management building. A security vulnerability exists in Koha version 21.11 and earlier, which stems from the supplierid parameter not being properly cleaned up, and could lead to SQL injection...
CVE-2025-22954: Improper Neutralization of Special Elements used in an SQL Command
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
CVE-2025-22954
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter...
CVE-2024-28740
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component...
CVE-2024-28739
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter...
CVE-2024-28740
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component...
