{"id":"CVE-2026-50765","aliases":["EUVD-2026-39940","GHSA-wh28-gg5r-p54p"],"status":"published","title":"Cross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of...","description":"A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0031,"percentile":0.2408,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-06-26T00:00:00Z","modified":"2026-10-28T02:30:50Z","products":[{"vendor":"koha","product":"koha"}],"references":[{"url":"https://lgnas.gitbook.io/findings/cve-2026-50765","tags":["exploit","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50765","tags":["advisory"]},{"url":"http://koha.com"},{"url":"https://github.com/advisories/GHSA-wh28-gg5r-p54p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50765.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50765","description":"A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).","status":"published","published":"2026-06-26T00:00:00Z","modified":"2026-07-05T01:35:56.887Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-39940","description":"A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).","status":"published","published":"2026-06-26T00:00:00Z","modified":"2026-07-05T01:35:56Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:14.2986Z"}],"ghsa":[{"id":"GHSA-wh28-gg5r-p54p","title":"Cross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of...","description":"Cross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System through 25.11 allows an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field)","status":"published","published":"2026-06-27T00:30:30Z","modified":"2026-06-29T15:33:09Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:03.268343Z"}],"nvd":[{"id":"CVE-2026-50765","description":"A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).","status":"published","published":"2026-06-26T22:16:32.5Z","modified":"2026-07-05T02:17:51.337Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-50765","description":"A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).","status":"published","published":"2026-06-26T00:00:00Z","modified":"2026-10-28T02:30:50.382874681Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:07.431113Z"}]}}