Skip to content
OpenAdvisories

Vendor

Koha Community

15 known vulnerabilities.

Products

Koha 15
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-41921

    Koha Stored XSS via Purchase Suggestion Handler

    Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save …

    Koha Community Koha
  • Medium 4.3
    CVE-2026-72610

    Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field.…

    Koha Community Koha
  • Medium 6.5
    CVE-2026-72608

    Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name val…

    Koha Community Koha