Koha Security Vulnerabilities and Issues — Koha CVE List

Lucene search

KohaKoha

5 matches found

CVE•added 2018/10/18 9:29 p.m.•52 views

CVE-2015-4633

Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticate...

9.8CVSS9.8AI score0.0426EPSS

CVE•added 2020/01/24 5:15 p.m.•47 views

CVE-2014-1925

SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE...

9.8CVSS9.4AI score0.04079EPSS

CVE•added 2020/01/24 5:15 p.m.•46 views

CVE-2014-1924

The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.

9.8CVSS9.7AI score0.04079EPSS

CVE•added 2024/08/06 7:15 p.m.•30 views

CVE-2024-28740

Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component.

9.6CVSS7.5AI score0.00506EPSS

CVE•added 2024/08/06 7:15 p.m.•28 views

CVE-2024-28739

An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.

9.6CVSS8AI score0.02243EPSS