Vulnerabilidades de Koha
CVEs publicadas que afetam produtos de Koha: 7 registro(s), com severidade, exploração e correções.
CVE-2026-50767
Média · 5.4
CWE-79 26/06/2026
Cross-site Scripting (XSS) em Koha
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field (checkinmsg).
CVE-2026-50766
Média · 5.4
CWE-79 26/06/2026
Cross-site Scripting (XSS) em Koha
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).
CVE-2026-50765
Média · 6.1
CWE-79 26/06/2026
Cross-site Scripting (XSS) em Koha
A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).
CVE-2026-26379
Média · 6.5
CWE-918 03/06/2026
Server-Side Request Forgery (SSRF) em Koha
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.
CVE-2026-26378
Média · 5.4
CWE-79 03/06/2026
Cross-site Scripting (XSS) em Koha
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features
CVE-2026-31844
Alta · 8.8
CWE-89 11/03/2026
Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.
CVE-2026-26377
Média · 5.4
CWE-79 05/03/2026
Cross-site Scripting (XSS) em Koha
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.