Koha
Monthly
SQL injection in Koha's acquisition module enables authenticated staff to blindly extract the entire database - including patron PII, staff bcrypt password hashes, and two-factor authentication secrets - via a crafted ORDER BY direction token in the acqui/parcels.pl endpoint. All active Koha release branches are affected through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01, meaning any library running a current release is exposed. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but successful exploitation yields credentials that could cascade into full staff account takeover.
Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permission to plant unsanitized SQL inside the 'automatic item modifications by age' configuration tool, which is later executed verbatim by the scheduled cron job through C4::Items::ToggleNewStatus. Successful exploitation exposes the entire Koha database - including patron personally identifiable information and staff password hashes - and lets the attacker manipulate which library items the batch modification job processes. No CISA KEV listing and no public exploit code have been identified at time of analysis; the deferred, cron-triggered execution model decouples the attacker's action from the database impact, complicating real-time detection.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
SQL injection in the Koha library management system's staff interface allows authenticated users to manipulate the displayby parameter in suggestion.pl, enabling arbitrary SQL query execution against the backend database. Low-privileged staff members can exploit this vulnerability to extract sensitive data or modify database contents without additional privileges. No patch is currently available to remediate this high-severity vulnerability.
Stored SQL injection in Koha across all active release branches (24.11, 25.05, 25.11, 26.05) allows authenticated library staff holding the edit_borrowers permission to plant a compact time-based SLEEP payload in a patron's lang field, causing recurring denial-of-service each time an issue slip is printed for that patron. The 25-character column constraint prevents practical data extraction, confining real-world impact strictly to workflow disruption in the circulation slip-printing path. No public exploit code or active exploitation has been identified at time of analysis; the attack requires valid staff credentials scoped to a specific Koha permission.
Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.
SQL injection in Koha's reports/catalogue_out.pl grants authenticated staff with the Reports module flag full read access to the Koha MariaDB database, including borrower password hashes, 2FA secrets, API keys, session tokens, and patron PII. The vulnerability traces to a 2008 commit and was overlooked when CVE-2015-4633 patched the same injection class in sibling files. A working single-request proof-of-concept using EXTRACTVALUE error-based extraction has been publicly disclosed; no CISA KEV listing has been confirmed at time of analysis, but the low exploitation barrier for credentialed staff makes this a high-priority remediation.
Koha versions 25.11 and earlier contain a stored cross-site scripting vulnerability in the News function that allows authenticated users to inject malicious scripts affecting other users who view the compromised content. Public exploit code exists for this vulnerability, and attackers can leverage it to steal session data or perform actions on behalf of victims. A patch is not currently available for affected deployments.
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in KOHA up to 23.05.03. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
SQL injection in Koha's acquisition module enables authenticated staff to blindly extract the entire database - including patron PII, staff bcrypt password hashes, and two-factor authentication secrets - via a crafted ORDER BY direction token in the acqui/parcels.pl endpoint. All active Koha release branches are affected through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01, meaning any library running a current release is exposed. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but successful exploitation yields credentials that could cascade into full staff account takeover.
Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permission to plant unsanitized SQL inside the 'automatic item modifications by age' configuration tool, which is later executed verbatim by the scheduled cron job through C4::Items::ToggleNewStatus. Successful exploitation exposes the entire Koha database - including patron personally identifiable information and staff password hashes - and lets the attacker manipulate which library items the batch modification job processes. No CISA KEV listing and no public exploit code have been identified at time of analysis; the deferred, cron-triggered execution model decouples the attacker's action from the database impact, complicating real-time detection.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
SQL injection in the Koha library management system's staff interface allows authenticated users to manipulate the displayby parameter in suggestion.pl, enabling arbitrary SQL query execution against the backend database. Low-privileged staff members can exploit this vulnerability to extract sensitive data or modify database contents without additional privileges. No patch is currently available to remediate this high-severity vulnerability.
Stored SQL injection in Koha across all active release branches (24.11, 25.05, 25.11, 26.05) allows authenticated library staff holding the edit_borrowers permission to plant a compact time-based SLEEP payload in a patron's lang field, causing recurring denial-of-service each time an issue slip is printed for that patron. The 25-character column constraint prevents practical data extraction, confining real-world impact strictly to workflow disruption in the circulation slip-printing path. No public exploit code or active exploitation has been identified at time of analysis; the attack requires valid staff credentials scoped to a specific Koha permission.
Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.
SQL injection in Koha's reports/catalogue_out.pl grants authenticated staff with the Reports module flag full read access to the Koha MariaDB database, including borrower password hashes, 2FA secrets, API keys, session tokens, and patron PII. The vulnerability traces to a 2008 commit and was overlooked when CVE-2015-4633 patched the same injection class in sibling files. A working single-request proof-of-concept using EXTRACTVALUE error-based extraction has been publicly disclosed; no CISA KEV listing has been confirmed at time of analysis, but the low exploitation barrier for credentialed staff makes this a high-priority remediation.
Koha versions 25.11 and earlier contain a stored cross-site scripting vulnerability in the News function that allows authenticated users to inject malicious scripts affecting other users who view the compromised content. Public exploit code exists for this vulnerability, and attackers can leverage it to steal session data or perform actions on behalf of victims. A patch is not currently available for affected deployments.
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl component. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in KOHA up to 23.05.03. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.