Koha vulnerabilities

Products

• Koha 27

Newest

• koha Koha Eval Code Injection Remote Code Execution Vulnerability CVE-2026-19780 8.8 HighSeptember 15, 2026
• koha A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha... CVE-2026-50767 5.4 MediumJune 26, 2026
• koha A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library... CVE-2026-50766 5.4 MediumJune 26, 2026
• koha Cross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of... CVE-2026-50765 6.1 MediumJune 26, 2026
• koha An issue in Koha v.25.11 and before allows a remote attacker to execute arbitrary code via the... CVE-2026-26379 6.5 MediumJune 3, 2026
• koha Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute... CVE-2026-26378 5.4 MediumJune 3, 2026
• koha Authenticated SQL Injection in Koha displayby parameter of suggestion.pl CVE-2026-31844 Public exploit 8.7 HighMarch 11, 2026
• koha Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute... CVE-2026-26377 5.4 MediumMarch 5, 2026
• koha Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the... CVE-2025-30076 7.7 HighMarch 16, 2025
• koha Koha <= 21.11 is contains a SQL Injection vulnerability in /serials/lateissues-export.pl via the... CVE-2025-22954 Public exploit EPSS 25.6% 10.0 CriticalMarch 12, 2025
• koha Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to... CVE-2024-28740 9.6 CriticalAugust 6, 2024
• koha An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a... CVE-2024-28739 EPSS 18.9% 7.2 HighAugust 6, 2024
• koha, koha-community koha library software +1 more CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in... CVE-2024-24337 8.0 HighFebruary 12, 2024
• koha KOHA MARC search.pl cross site scripting CVE-2023-5025 3.5 LowSeptember 17, 2023
• koha SQL injection vulnerability in the MARC framework import/export function (admin... CVE-2014-1925 9.8 CriticalJanuary 24, 2020
• koha The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8... CVE-2014-1924 9.8 CriticalJanuary 24, 2020
• koha Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before... CVE-2014-1922 7.5 HighJanuary 24, 2020
• koha Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl)... CVE-2014-1923 7.5 HighJanuary 24, 2020
• koha Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18... CVE-2015-4633 Public exploit 9.8 CriticalOctober 18, 2018
• koha Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12... CVE-2015-4632 Public exploit EPSS 51.8% 7.5 HighOctober 18, 2018
• koha Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before... CVE-2015-4631 Public exploit 5.4 MediumOctober 18, 2018
• koha Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x... CVE-2015-4630 Public exploit 8.0 HighOctober 18, 2018
• koha KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains... CVE-2018-1000670 6.1 MediumSeptember 6, 2018
• koha KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains... CVE-2018-1000669 8.8 HighSeptember 6, 2018
• koha Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14... CVE-2015-4639 8.8 HighJuly 21, 2017
• koha Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and... CVE-2014-9446 4.3 MediumJanuary 2, 2015
• koha, koha liblime koha +1 more Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6... CVE-2011-4715 Public exploit 5.0 MediumDecember 8, 2011