Browse CVEs

MEDIUM 6.1 CVE-2026-50765 A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.1… Koha after 25.11.00 Fix from $1,6002026-06-26 MEDIUM 5.4 CVE-2026-50766 A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an au… Koha after 25.11.00 Fix from $1,6002026-06-26 MEDIUM 5.4 CVE-2026-50767 A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions all… Koha after 25.11.00 Fix from $1,6002026-06-26 MEDIUM 6.5 CVE-2026-26379 Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticat… Koha after 25.11.00 Fix from $1,6002026-06-03 MEDIUM 5.4 CVE-2026-26378 Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice fe… Koha after 25.11.00 Fix from $1,6002026-06-03 HIGH 8.8 CVE-2026-31844 An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due t… Koha 24.11.12 / 25.05.07+ Fix from $1,9502026-03-11 MEDIUM 5.4 CVE-2026-26377 Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function. Koha after 25.11.00 Fix from $1,6002026-03-05 CRITICAL 9.6 CVE-2024-28740 Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-contents.pl comp… Koha after 23.05.00 Fix from $2,3002024-08-06 HIGH 7.2 CVE-2024-28739EPSS 19% An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. Koha after 23.05.00 Fix from $1,9502024-08-06 HIGH 8.0 CVE-2024-24337 CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and ea… Koha after 23.05.05 Fix from $1,9502024-02-12 MEDIUM 5.4 CVE-2023-5025 A vulnerability was found in KOHA up to 23.05.03. It has been declared as problematic. This vulnerability affects unknown code of the file /cgi-bin/k… Koha after 23.05.03 Fix from $1,6002023-09-17 CRITICAL 9.8 CVE-2014-1924 The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and… Koha 3.08.23 / 3.10.13+ Fix from $2,3002020-01-24 CRITICAL 9.8 CVE-2014-1925 SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10… Koha 3.08.23 / 3.10.13+ Fix from $2,3002020-01-24 HIGH 7.5 CVE-2014-1922 Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.… Koha 3.08.23 / 3.10.13+ Fix from $1,9502020-01-24 HIGH 7.5 CVE-2014-1923 Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3… Koha 3.08.23 / 3.10.13+ Fix from $1,9502020-01-24 CRITICAL 9.8 CVE-2015-4633EPSS 6% Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1… Koha 3.14.16 / 3.16.12+ Fix from $2,3002018-10-18 HIGH 7.5 CVE-2015-4632EPSS 52% Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 al… Koha 3.14.16 / 3.16.12+ Fix from $1,9502018-10-18 HIGH 8.0 CVE-2015-4630 Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x be… Koha 3.14.16 / 3.16.12+ Fix from $1,9502018-10-18 MEDIUM 5.4 CVE-2015-4631 Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.… Koha 3.14.16 / 3.16.12+ Fix from $1,6002018-10-18 HIGH 8.8 CVE-2018-1000669 KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in… Koha after 17.05.05 Fix from $1,9502018-09-06 MEDIUM 6.1 CVE-2018-1000670 KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multip… Koha after 17.05.05 Fix from $1,6002018-09-06 HIGH 8.8 CVE-2015-4639 Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 … Koha Mitigation only Fix from $1,9502017-07-21 MEDIUM 5.0 CVE-2011-4715EPSS 9% Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows … Liblime Koha after 4.2 Fix from $1,6002011-12-08