1446 matches found
PT-2026-71002
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...
CVE-2026-72609
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
EUVD-2026-56131
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...
CVE-2026-72610
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...
CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
CVE-2026-72609
Koha vulnerability CVE-2026-72609: An SQL injection in Koha up to versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01 affects the acqui/parcels.pl flow. Authenticated staff with acquisition => order_receive permission can read arbitrary database contents via the orderby parameter passed to C4:...
CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...
CVE-2026-72607
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...
CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...
CVE-2026-72558
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72725
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
EUVD-2026-55664
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
CVE-2026-72725
Discourse (open‑source discussion platform) has a Stored XSS issue in the staff action log: prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields, enabling stored XSS in the staff interface. The vulnerability is fixed in versions 2026.1.6, 2026.5.2, 2026.6...
CVE-2026-72725 Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
CVE-2026-48074
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
CVE-2026-48074
OpenReception OpenReception: CVE-2026-48074 describes a cross-tenant data cleanup bug in Staff deletion. Before v1.0.6, deleting a staff member triggers an invite cleanup that removes from the central user_invite table by email without scoping to tenantId. As a result, a TENANT_ADMIN in one tenan...
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...