{"id":"CVE-2015-4631","aliases":["EUVD-2015-4650","GHSA-24mg-jwcv-j892"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03711,"percentile":0.89838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2018-10-18T20:00:00Z","modified":"2026-06-17T00:27:38Z","exploits":[{"source":"exploitdb","id":"EDB-37389","title":"Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities","type":"webapps","platform":"php","date":"2015-06-26","url":"https://www.exploit-db.com/exploits/37389"}],"products":[{"vendor":"koha","product":"koha"}],"references":[{"url":"https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/37389/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://koha-community.org/security-release-koha-3-16-12/","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","Vendor Advisory"]},{"url":"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking"]},{"url":"https://seclists.org/fulldisclosure/2015/Jun/80","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://koha-community.org/security-release-koha-3-18-8/","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","Vendor Advisory"]},{"url":"https://koha-community.org/security-release-koha-3-20-1/","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","Vendor Advisory"]},{"url":"https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://koha-community.org/koha-3-14-16-released/","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4631"},{"url":"https://github.com/advisories/GHSA-24mg-jwcv-j892"}],"sources":{"cve":[{"id":"CVE-2015-4631","description":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.","status":"published","published":"2018-10-18T20:00:00Z","modified":"2024-08-06T06:18:12.212Z","updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4650","description":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.","status":"published","published":"2018-10-18T20:00:00Z","modified":"2024-08-06T06:18:12Z","updated_at":"2026-11-03T02:22:03.142599Z"}],"ghsa":[{"id":"GHSA-24mg-jwcv-j892","title":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before...","description":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.","status":"published","published":"2022-05-14T01:53:12Z","modified":"2023-02-02T05:04:43Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:56.457493Z"}],"nvd":[{"id":"CVE-2015-4631","description":"Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.","status":"published","published":"2018-10-18T21:29:00.723Z","modified":"2026-06-17T00:27:38.003Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:19.73542Z"}]}}