Search
Find a vulnerability
Search criteria
26 vulnerabilities found for Koha by Koha Community
CVE-2026-41921 (GCVE-0-2026-41921)
Vulnerability from nvd – Published: 2026-08-18 21:09 – Updated: 2026-08-21 19:15
VLAI
EPSS
VEX
Title
Koha Stored XSS via Purchase Suggestion Handler
Summary
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://koha-community.org/koha-26-05-02-released/ | release-notes |
| https://koha-community.org/koha-25-11-07-released/ | release-notes |
| https://koha-community.org/koha-25-05-13-released/ | release-notes |
| https://www.vulncheck.com/advisories/koha-stored-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
26.05.0 , < 26.05.02
(custom)
Affected: 25.11.0 , < 25.11.07 (custom) Affected: 25.05.0 , < 25.05.13 (custom) |
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:15:29.766744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:15:42.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Williams from Pellera Technologies"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T21:09:48.910Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "v26.05.02 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-26-05-02-released/"
},
{
"name": "v25.11.07 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-11-07-released/"
},
{
"name": "v25.05.13 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-05-13-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Koha Stored XSS via Purchase Suggestion Handler",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-41921",
"datePublished": "2026-08-18T21:09:48.910Z",
"dateReserved": "2026-04-22T18:50:43.619Z",
"dateUpdated": "2026-08-21T19:15:42.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72610 (GCVE-0-2026-72610)
Vulnerability from nvd – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:02
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:02 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:02:14.559828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:02:46.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers =\u003e edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents-\u003esearch_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:47.134Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42866",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42866"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72610",
"datePublished": "2026-08-11T11:22:47.134Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:02:46.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72609 (GCVE-0-2026-72609)
Vulnerability from nvd – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:06
VLAI
EPSS
VEX
Title
Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
Summary
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:05 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:05:12.929371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:06:02.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:44.903Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42749",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72609",
"datePublished": "2026-08-11T11:22:44.903Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:06:02.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72608 (GCVE-0-2026-72608)
Vulnerability from nvd – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:07
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:07 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:07:20.469478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:07:56.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools =\u003e label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:14.074Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42747",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72608",
"datePublished": "2026-08-11T11:22:14.074Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:07:56.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72607 (GCVE-0-2026-72607)
Vulnerability from nvd – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:10
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:08 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:08:50.387022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:10:18.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools =\u003e items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:40:06.669Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42746",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72607",
"datePublished": "2026-08-11T11:22:12.949Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:10:18.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71288 (GCVE-0-2026-71288)
Vulnerability from nvd – Published: 2026-08-05 12:26 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
Summary
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:49 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Koha-Community/Koha | third-party-advisory |
| https://github.com/Koha-Community/Koha/blob/maste… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 26.05.01-1
(semver)
|
Date Public
2026-08-05 12:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:49:52.767160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:49:58.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/guided_reports.pl",
"C4/Reports/Guided.pm"
],
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "26.05.01-1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-08-05T12:26:34.034Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.\u003c/p\u003e"
}
],
"value": "Koha\u0027s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:19.921Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Koha-Community/Koha"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71288",
"datePublished": "2026-08-05T12:26:34.034Z",
"dateReserved": "2026-08-05T12:23:34.968Z",
"dateUpdated": "2026-08-10T11:47:19.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70373 (GCVE-0-2026-70373)
Vulnerability from nvd – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/issues_stats.pl
Summary
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:23 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:23:16.261202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:23:32.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/issues_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:15.197Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:46.722Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/issues_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70373",
"datePublished": "2026-08-04T13:00:15.197Z",
"dateReserved": "2026-08-04T07:13:07.993Z",
"dateUpdated": "2026-08-10T11:44:46.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70372 (GCVE-0-2026-70372)
Vulnerability from nvd – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/bor_issues_top.pl
Summary
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:22 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:22:31.575799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:23:04.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/bor_issues_top.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:12.836Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:44.671Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/bor_issues_top.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70372",
"datePublished": "2026-08-04T13:00:12.836Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:44.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70371 (GCVE-0-2026-70371)
Vulnerability from nvd – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/issues_avg_stats.pl
Summary
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:21 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:21:38.231269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:21:56.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/issues_avg_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:10.726Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:42.609Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/issues_avg_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70371",
"datePublished": "2026-08-04T13:00:10.726Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:42.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70370 (GCVE-0-2026-70370)
Vulnerability from nvd – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/catalogue_stats.pl
Summary
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:20 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:20:50.487239Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:21:08.809Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/catalogue_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:07.967Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:40.413Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/catalogue_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70370",
"datePublished": "2026-08-04T13:00:07.967Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:40.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70369 (GCVE-0-2026-70369)
Vulnerability from nvd – Published: 2026-08-04 12:59 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/acquisitions_stats.pl
Summary
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:20 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 12:59
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:20:31.267167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:20:36.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/acquisitions_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T12:59:55.938Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:38.356Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/acquisitions_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70369",
"datePublished": "2026-08-04T12:59:55.938Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:38.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6428 (GCVE-0-2026-6428)
Vulnerability from nvd – Published: 2026-06-13 16:34 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
Summary
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 17:19 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | issue-trackingvendor-advisory |
| https://bugs.koha-community.org/bugzilla3/attachm… | patchvendor-advisory |
| https://koha-community.org/security-releases/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 22.11.38
(semver)
Affected: 23.05.00 , ≤ 23.11.15 (semver) Affected: 24.05.00 , ≤ 24.11.16 (semver) Affected: 25.05.00 , ≤ 25.05.11 (semver) Affected: 25.11.00 , ≤ 25.11.05 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-06-13 16:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T17:19:10.550362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T17:19:39.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/catalogue_out.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "22.11.38",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "23.11.15",
"status": "affected",
"version": "23.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.11.16",
"status": "affected",
"version": "24.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.11",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.05",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov (Sanjarbiy)"
}
],
"datePublic": "2026-06-13T16:34:10.326Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e"
}
],
"value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database."
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:35.818Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter",
"tags": [
"issue-tracking",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
},
{
"name": "Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)",
"tags": [
"patch",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
},
{
"name": "Koha Community Security Releases",
"tags": [
"vendor-advisory"
],
"url": "https://koha-community.org/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter",
"x_author": "Sanjar Tulkinov (Sanjarbiy)"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-6428",
"datePublished": "2026-06-13T16:34:10.326Z",
"dateReserved": "2026-04-16T12:58:10.800Z",
"dateUpdated": "2026-08-10T11:44:35.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31844 (GCVE-0-2026-31844)
Vulnerability from nvd – Published: 2026-03-11 06:34 – Updated: 2026-08-10 11:43 X_Open Source
VLAI
EPSS
VEX
Title
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
Summary
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 14:01 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | issue-tracking |
| https://koha-community.gitlab.io/KohaAdvent/2025-… | vendor-advisory |
| https://koha-community.org/koha-25-11-01-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
24.11.0 , ≤ 24.11.12
(semver)
Affected: 25.05.0 , ≤ 25.05.07 (semver) Affected: 25.11.0 , ≤ 25.11.01 (semver) |
Date Public
2026-03-11 06:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31844",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T14:01:54.335981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T14:02:52.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.12",
"status": "affected",
"version": "24.11.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.07",
"status": "affected",
"version": "25.05.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.01",
"status": "affected",
"version": "25.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Raximov Shukrulloh (Mothra)"
}
],
"datePublic": "2026-03-11T06:34:14.869Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.\u003c/p\u003e"
}
],
"value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 \u2014 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:43:33.492Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/"
},
{
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-11-01-released/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Authenticated SQL Injection in Koha displayby parameter of suggestion.pl",
"x_generator": {
"engine": "Vulnogram"
}
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-31844",
"datePublished": "2026-03-11T06:34:14.869Z",
"dateReserved": "2026-03-09T18:20:23.398Z",
"dateUpdated": "2026-08-10T11:43:33.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41921 (GCVE-0-2026-41921)
Vulnerability from cvelistv5 – Published: 2026-08-18 21:09 – Updated: 2026-08-21 19:15
VLAI
EPSS
VEX
Title
Koha Stored XSS via Purchase Suggestion Handler
Summary
Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://koha-community.org/koha-26-05-02-released/ | release-notes |
| https://koha-community.org/koha-25-11-07-released/ | release-notes |
| https://koha-community.org/koha-25-05-13-released/ | release-notes |
| https://www.vulncheck.com/advisories/koha-stored-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
26.05.0 , < 26.05.02
(custom)
Affected: 25.11.0 , < 25.11.07 (custom) Affected: 25.05.0 , < 25.05.13 (custom) |
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:15:29.766744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:15:42.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Williams from Pellera Technologies"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T21:09:48.910Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "v26.05.02 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-26-05-02-released/"
},
{
"name": "v25.11.07 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-11-07-released/"
},
{
"name": "v25.05.13 Release Notes",
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-05-13-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Koha Stored XSS via Purchase Suggestion Handler",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-41921",
"datePublished": "2026-08-18T21:09:48.910Z",
"dateReserved": "2026-04-22T18:50:43.619Z",
"dateUpdated": "2026-08-21T19:15:42.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72610 (GCVE-0-2026-72610)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:02
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:02 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:02:14.559828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:02:46.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers =\u003e edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents-\u003esearch_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:47.134Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42866",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42866"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72610",
"datePublished": "2026-08-11T11:22:47.134Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:02:46.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72609 (GCVE-0-2026-72609)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:06
VLAI
EPSS
VEX
Title
Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
Summary
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:05 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:05:12.929371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:06:02.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition =\u003e order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:44.903Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42749",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72609",
"datePublished": "2026-08-11T11:22:44.903Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:06:02.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72608 (GCVE-0-2026-72608)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:07
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:07 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:07:20.469478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:07:56.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools =\u003e label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:22:14.074Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42747",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72608",
"datePublished": "2026-08-11T11:22:14.074Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:07:56.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72607 (GCVE-0-2026-72607)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:22 – Updated: 2026-08-11 12:10
VLAI
EPSS
VEX
Title
Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
Summary
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 12:08 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , < 24.11.18
(custom)
Affected: 25.05.0 , < 25.05.13 (custom) Affected: 25.11.0 , < 25.11.07 (custom) Affected: 26.05.0 , < 26.05.02 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T12:08:50.387022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T12:10:18.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThan": "24.11.18",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.05.13",
"status": "affected",
"version": "25.05.0",
"versionType": "custom"
},
{
"lessThan": "25.11.07",
"status": "affected",
"version": "25.11.0",
"versionType": "custom"
},
{
"lessThan": "26.05.02",
"status": "affected",
"version": "26.05.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar og\u02bbli (sanjarbiy11@gmail.com)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools =\u003e items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:40:06.669Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42746",
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746"
},
{
"name": "Koha Community",
"url": "https://koha-community.org/"
}
],
"title": "Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72607",
"datePublished": "2026-08-11T11:22:12.949Z",
"dateReserved": "2026-08-10T10:33:03.258Z",
"dateUpdated": "2026-08-11T12:10:18.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71288 (GCVE-0-2026-71288)
Vulnerability from cvelistv5 – Published: 2026-08-05 12:26 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
Summary
Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:49 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Koha-Community/Koha | third-party-advisory |
| https://github.com/Koha-Community/Koha/blob/maste… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 26.05.01-1
(semver)
|
Date Public
2026-08-05 12:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:49:52.767160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:49:58.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/guided_reports.pl",
"C4/Reports/Guided.pm"
],
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "26.05.01-1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-08-05T12:26:34.034Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.\u003c/p\u003e"
}
],
"value": "Koha\u0027s guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:19.921Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Koha-Community/Koha"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/Koha-Community/Koha/blob/master/reports/guided_reports.pl"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71288",
"datePublished": "2026-08-05T12:26:34.034Z",
"dateReserved": "2026-08-05T12:23:34.968Z",
"dateUpdated": "2026-08-10T11:47:19.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70373 (GCVE-0-2026-70373)
Vulnerability from cvelistv5 – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/issues_stats.pl
Summary
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:23 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:23:16.261202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:23:32.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/issues_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:15.197Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:46.722Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/issues_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70373",
"datePublished": "2026-08-04T13:00:15.197Z",
"dateReserved": "2026-08-04T07:13:07.993Z",
"dateUpdated": "2026-08-10T11:44:46.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70372 (GCVE-0-2026-70372)
Vulnerability from cvelistv5 – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/bor_issues_top.pl
Summary
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:22 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:22:31.575799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:23:04.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/bor_issues_top.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:12.836Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:44.671Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/bor_issues_top.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70372",
"datePublished": "2026-08-04T13:00:12.836Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:44.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70371 (GCVE-0-2026-70371)
Vulnerability from cvelistv5 – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/issues_avg_stats.pl
Summary
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:21 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:21:38.231269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:21:56.672Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/issues_avg_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:10.726Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:42.609Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/issues_avg_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70371",
"datePublished": "2026-08-04T13:00:10.726Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:42.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70370 (GCVE-0-2026-70370)
Vulnerability from cvelistv5 – Published: 2026-08-04 13:00 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/catalogue_stats.pl
Summary
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:20 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:20:50.487239Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:21:08.809Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/catalogue_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T13:00:07.967Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:40.413Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/catalogue_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70370",
"datePublished": "2026-08-04T13:00:07.967Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:40.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70369 (GCVE-0-2026-70369)
Vulnerability from cvelistv5 – Published: 2026-08-04 12:59 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha - SQL Injection in reports/acquisitions_stats.pl
Summary
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.
Severity
8.8 (High)
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:20 UTC
CWE
- CWE-89 - SQL Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | third-party-advisory |
| https://koha-community.org/koha-25-05-12-released/ | third-party-advisory |
| https://download.koha-community.org/koha-25.05.12… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 24.11.17
(semver)
Affected: 25.05.00 , ≤ 25.05.12 (semver) Affected: 25.11.00 , ≤ 25.11.06 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-08-04 12:59
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-70369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:20:31.267167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:20:36.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/acquisitions_stats.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.12",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.06",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
}
],
"datePublic": "2026-08-04T12:59:55.938Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKoha\u0027s reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.\u003c/p\u003e"
}
],
"value": "Koha\u0027s reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:38.356Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://koha-community.org/koha-25-05-12-released/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha - SQL Injection in reports/acquisitions_stats.pl"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-70369",
"datePublished": "2026-08-04T12:59:55.938Z",
"dateReserved": "2026-08-04T07:13:07.992Z",
"dateUpdated": "2026-08-10T11:44:38.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6428 (GCVE-0-2026-6428)
Vulnerability from cvelistv5 – Published: 2026-06-13 16:34 – Updated: 2026-08-10 11:44
VLAI
EPSS
VEX
Title
Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
Summary
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 17:19 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | issue-trackingvendor-advisory |
| https://bugs.koha-community.org/bugzilla3/attachm… | patchvendor-advisory |
| https://koha-community.org/security-releases/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
0 , ≤ 22.11.38
(semver)
Affected: 23.05.00 , ≤ 23.11.15 (semver) Affected: 24.05.00 , ≤ 24.11.16 (semver) Affected: 25.05.00 , ≤ 25.05.11 (semver) Affected: 25.11.00 , ≤ 25.11.05 (semver) Affected: 26.05.00 , ≤ 26.05.01 (semver) |
Date Public
2026-06-13 16:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T17:19:10.550362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T17:19:39.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://koha-community.org/",
"defaultStatus": "unaffected",
"product": "Koha",
"programFiles": [
"reports/catalogue_out.pl"
],
"repo": "https://gitlab.com/koha-community/Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "22.11.38",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "23.11.15",
"status": "affected",
"version": "23.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.11.16",
"status": "affected",
"version": "24.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.11",
"status": "affected",
"version": "25.05.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.05",
"status": "affected",
"version": "25.11.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.05.01",
"status": "affected",
"version": "26.05.00",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sanjar Tulkinov (Sanjarbiy)"
}
],
"datePublic": "2026-06-13T16:34:10.326Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.\u003c/p\u003e"
}
],
"value": "SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module permission can inject arbitrary SQL into the auxiliary $strsth2 statement built inside sub calculate when $tablename eq \u0027branches\u0027. Because the statement is sent to DBI without bound parameters, the attacker can read any row and column accessible to the Koha application database user, including the borrowers table (password hashes, two-factor authentication secrets, personally identifiable information), borrower_password_recovery, api_keys, sessions, and all circulation data. Error-based exfiltration is single-request (EXTRACTVALUE) and exposed through the DBI exception surfaced by the Reports CGI; time-based extraction and denial of service against the database remain possible even after the related information-disclosure issue (Koha bug 42366) is patched."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/AU:Y/V:C/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "An authenticated staff user holding the Reports module flag sends a crafted GET request to /cgi-bin/koha/reports/catalogue_out.pl with Criteria=branchcode and a malicious Filter parameter to read arbitrary data from the Koha application database."
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:44:35.818Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Koha Bug 42361 - SQL Injection in reports/catalogue_out.pl via Filter parameter",
"tags": [
"issue-tracking",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42361"
},
{
"name": "Bug 42361: Fix SQL injection in catalogue_out.pl (official patch)",
"tags": [
"patch",
"vendor-advisory"
],
"url": "https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199539"
},
{
"name": "Koha Community Security Releases",
"tags": [
"vendor-advisory"
],
"url": "https://koha-community.org/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter",
"x_author": "Sanjar Tulkinov (Sanjarbiy)"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-6428",
"datePublished": "2026-06-13T16:34:10.326Z",
"dateReserved": "2026-04-16T12:58:10.800Z",
"dateUpdated": "2026-08-10T11:44:35.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31844 (GCVE-0-2026-31844)
Vulnerability from cvelistv5 – Published: 2026-03-11 06:34 – Updated: 2026-08-10 11:43 X_Open Source
VLAI
EPSS
VEX
Title
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
Summary
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 14:01 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugs.koha-community.org/bugzilla3/show_bu… | issue-tracking |
| https://koha-community.gitlab.io/KohaAdvent/2025-… | vendor-advisory |
| https://koha-community.org/koha-25-11-01-released/ | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Koha Community | Koha |
Affected:
24.11.0 , ≤ 24.11.12
(semver)
Affected: 25.05.0 , ≤ 25.05.07 (semver) Affected: 25.11.0 , ≤ 25.11.01 (semver) |
Date Public
2026-03-11 06:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31844",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T14:01:54.335981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T14:02:52.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Koha",
"vendor": "Koha Community",
"versions": [
{
"lessThanOrEqual": "24.11.12",
"status": "affected",
"version": "24.11.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.05.07",
"status": "affected",
"version": "25.05.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "25.11.01",
"status": "affected",
"version": "25.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Raximov Shukrulloh (Mothra)"
}
],
"datePublic": "2026-03-11T06:34:14.869Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.\u003c/p\u003e"
}
],
"value": "An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 \u2014 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:43:33.492Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://koha-community.gitlab.io/KohaAdvent/2025-12-09-security-all/"
},
{
"tags": [
"release-notes"
],
"url": "https://koha-community.org/koha-25-11-01-released/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Authenticated SQL Injection in Koha displayby parameter of suggestion.pl",
"x_generator": {
"engine": "Vulnogram"
}
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-31844",
"datePublished": "2026-03-11T06:34:14.869Z",
"dateReserved": "2026-03-09T18:20:23.398Z",
"dateUpdated": "2026-08-10T11:43:33.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}