Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

KOHA — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in KOHA, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the KOHA library automation system, focusing on specific weakness classes and associated CVE entries. It collects a comprehensive history of security flaws identified in KOHA releases over the past several years, covering issues like cross-site scripting, SQL injection, and authentication bypass. Readers can use this resource to track the vendor’s security advisories, analyze recurring weakness patterns, and review the complete vulnerability timeline for this product without needing to search individual databases. The data is organized to facilitate trend analysis and risk assessment for organizations running KOHA instances.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability CWE-95 - - 2026-09-15
CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler CWE-79 5.4 Medium 2026-08-18
CVE-2026-72610 Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation CWE-89 4.3 Medium 2026-08-11
CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl CWE-89 7.1 High 2026-08-11
CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name CWE-89 6.5 Medium 2026-08-11
CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age CWE-89 7.1 High 2026-08-11
CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl CWE-89 8.8 High 2026-08-05
CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl CWE-89 8.8 High 2026-08-04
CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl CWE-89 8.8 High 2026-08-04
CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl CWE-89 8.8 High 2026-08-04
CVE-2026-70370 Koha - SQL Injection in reports/catalogue_stats.pl CWE-89 8.8 High 2026-08-04
CVE-2026-70369 Koha - SQL Injection in reports/acquisitions_stats.pl CWE-89 8.8 High 2026-08-04
CVE-2026-6428 Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter CWE-89 7.6 High 2026-06-13
CVE-2026-31844 Authenticated SQL Injection in Koha displayby parameter of suggestion.pl CWE-89 8.8 High 2026-03-11
CVE-2025-30076 Koha 操作系统命令注入漏洞 CWE-78 7.7 High 2025-03-16
CVE-2025-22954 Koha 安全漏洞 CWE-89 10.0 Critical 2025-03-12
CVE-2018-25101 l2c2technologies Koha opac-MARCdetail.pl cross site scripting CWE-79 3.5 Low 2024-04-22
CVE-2023-5025 KOHA MARC search.pl cross site scripting CWE-79 3.5 Low 2023-09-17

All 18 known CVE vulnerabilities affecting KOHA with full Chinese analysis, references, and POCs where available.