Advisories · Technology

Koha.

Every CVE that names Koha among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-105107 CVE record

CVSS 7.2 High

Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
- Koha
- SQL injection
Not analysed yet 14 Oct 2026
CVE-2026-105106 CVE record

CVSS 8.8 High

Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
- Koha
- Command injection
Not analysed yet 14 Oct 2026
CVE-2026-19780 CVE record

CVSS 8.8 High

Koha Eval Code Injection Remote Code Execution Vulnerability
- Koha
- Code injection
Not analysed yet 15 Sept 2026
CVE-2026-41921 CVE record

CVSS 5.1 Medium

Koha Stored XSS via Purchase Suggestion Handler
- Koha
- Cross-site scripting (XSS)
Not analysed yet 18 Aug 2026
CVE-2026-72610 CVE record

CVSS 4.3 Medium

Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
- Koha
- SQL injection
Not analysed yet 11 Aug 2026
CVE-2026-72609 CVE record

CVSS 7.1 High

Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
- Koha
- SQL injection
Not analysed yet 11 Aug 2026
CVE-2026-72608 CVE record

CVSS 6.5 Medium

Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
- Koha
- SQL injection
Not analysed yet 11 Aug 2026
CVE-2026-72607 CVE record

CVSS 7.1 High

Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
- Koha
- SQL injection
Not analysed yet 11 Aug 2026
CVE-2026-71288 CVE record

CVSS 8.8 High

Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl
- Koha
- SQL injection
Not analysed yet 5 Aug 2026
CVE-2026-70373 CVE record

CVSS 8.8 High

Koha - SQL Injection in reports/issues_stats.pl
- Koha
- SQL injection
Not analysed yet 4 Aug 2026
CVE-2026-70372 CVE record

CVSS 8.8 High

Koha - SQL Injection in reports/bor_issues_top.pl
- Koha
- SQL injection
Not analysed yet 4 Aug 2026
CVE-2026-70371 CVE record

CVSS 8.8 High

Koha - SQL Injection in reports/issues_avg_stats.pl
- Koha
- SQL injection
Not analysed yet 4 Aug 2026
CVE-2026-70370 CVE record

CVSS 8.8 High

Koha - SQL Injection in reports/catalogue_stats.pl
- Koha
- SQL injection
Not analysed yet 4 Aug 2026
CVE-2026-70369 CVE record

CVSS 8.8 High

Koha - SQL Injection in reports/acquisitions_stats.pl
- Koha
- SQL injection
Not analysed yet 4 Aug 2026
CVE-2026-6428 CVE record

CVSS 5.6 Medium

Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
- Koha
- SQL injection
Not analysed yet 13 Jun 2026
CVE-2026-31844 CVE record

CVSS 8.7 High

Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
- Koha
- SQL injection
Not analysed yet 11 Mar 2026
CVE-2025-30076 CVE record

CVSS 7.7 High

OS command injection in Koha
- Koha
- Command injection
Not analysed yet 16 Mar 2025
CVE-2025-22954 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SQL injection in Koha
- Koha
- SQL injection
Not analysed yet 12 Mar 2025
CVE-2023-5025 CVE record

CVSS 3.5 Low

KOHA MARC search.pl cross site scripting
- KOHA
- Cross-site scripting (XSS)
Not analysed yet 17 Sept 2023