# Koha.

Every CVE that names Koha among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters](https://agentprime.io/advisories/CVE-2026-105107.md)
  `CVE-2026-105107` · CVE record: Koha Community Koha · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task](https://agentprime.io/advisories/CVE-2026-105106.md)
  `CVE-2026-105106` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Koha Eval Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-19780.md)
  `CVE-2026-19780` · CVE record: Koha Koha · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Code injection
- [Koha Stored XSS via Purchase Suggestion Handler](https://agentprime.io/advisories/CVE-2026-41921.md)
  `CVE-2026-41921` · CVE record: Koha Community Koha · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation](https://agentprime.io/advisories/CVE-2026-72610.md)
  `CVE-2026-72610` · CVE record: Koha Community Koha · CVSS 4.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl](https://agentprime.io/advisories/CVE-2026-72609.md)
  `CVE-2026-72609` · CVE record: Koha Community Koha · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name](https://agentprime.io/advisories/CVE-2026-72608.md)
  `CVE-2026-72608` · CVE record: Koha Community Koha · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age](https://agentprime.io/advisories/CVE-2026-72607.md)
  `CVE-2026-72607` · CVE record: Koha Community Koha · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: SQL injection
- [Koha SQL Injection via order_by and {order}\_ovalue Parameters in guided_reports.pl](https://agentprime.io/advisories/CVE-2026-71288.md)
  `CVE-2026-71288` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: SQL injection
- [Koha - SQL Injection in reports/issues_stats.pl](https://agentprime.io/advisories/CVE-2026-70373.md)
  `CVE-2026-70373` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection
- [Koha - SQL Injection in reports/bor_issues_top.pl](https://agentprime.io/advisories/CVE-2026-70372.md)
  `CVE-2026-70372` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection
- [Koha - SQL Injection in reports/issues_avg_stats.pl](https://agentprime.io/advisories/CVE-2026-70371.md)
  `CVE-2026-70371` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection
- [Koha - SQL Injection in reports/catalogue_stats.pl](https://agentprime.io/advisories/CVE-2026-70370.md)
  `CVE-2026-70370` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection
- [Koha - SQL Injection in reports/acquisitions_stats.pl](https://agentprime.io/advisories/CVE-2026-70369.md)
  `CVE-2026-70369` · CVE record: Koha Community Koha · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2026 · Tags: SQL injection
- [Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter](https://agentprime.io/advisories/CVE-2026-6428.md)
  `CVE-2026-6428` · CVE record: Koha Community Koha · CVSS 5.6 Medium · Not analysed yet · Published 13 Jun 2026 · Tags: SQL injection
- [Authenticated SQL Injection in Koha displayby parameter of suggestion.pl](https://agentprime.io/advisories/CVE-2026-31844.md)
  `CVE-2026-31844` · CVE record: Koha Community Koha · CVSS 8.7 High · Not analysed yet · Published 11 Mar 2026 · Tags: SQL injection
- [OS command injection in Koha](https://agentprime.io/advisories/CVE-2025-30076.md)
  `CVE-2025-30076` · CVE record: Koha Koha · CVSS 7.7 High · Not analysed yet · Published 16 Mar 2025 · Tags: Command injection
- [SQL injection in Koha](https://agentprime.io/advisories/CVE-2025-22954.md)
  `CVE-2025-22954` · CVE record: Koha Koha · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 12 Mar 2025 · Tags: SQL injection
- [KOHA MARC search.pl cross site scripting](https://agentprime.io/advisories/CVE-2023-5025.md)
  `CVE-2023-5025` · CVE record: KOHA · CVSS 3.5 Low · Not analysed yet · Published 17 Sept 2023 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=koha>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/koha/>. Everything for agents: <https://agentprime.io/llms.txt>.