Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Koha 24.11.18, 25.05.13 and 2 more versions Clear all filters
TI-2026-50867 CVE-2026-72610 · GHSA-jjgf-vgv7-fgjv

Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

Priority LOW 20

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storin…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00336 Published 2026-08-11 Fixed in 24.11.18, 25.05.13 +2 CWE-89
TI-2026-50866 CVE-2026-72609 · GHSA-f66q-gpm5-hp2p

Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl

Priority LOW 31

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby re…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00371 Published 2026-08-11 Fixed in 24.11.18, 25.05.13 +2 CWE-89
TI-2026-50865 CVE-2026-72608 · GHSA-xg24-96fx-vx3g

Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

Priority LOW 29

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00379 Published 2026-08-11 Fixed in 24.11.18, 25.05.13 +2 CWE-89
TI-2026-50864 CVE-2026-72607 · GHSA-wghp-4m28-j8pj

Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

Priority LOW 32

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00451 Published 2026-08-11 Fixed in 24.11.18, 25.05.13 +2 CWE-89