Koha Library Software vulnerabilities

3 known vulnerabilities in Koha Library Software from Koha Community. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  koha_library_software: Cross-Site Request Forgery

  CVE-2024-24336Mar 19, 2024Koha Community

  A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including u

• 8.0 High severity

  koha_library_software: Improper Neutralization of Formula Elements in a CSV File

  CVE-2024-24337Feb 12, 2024Koha Community

  CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' compone

• 7.5 High severity

  Koha Library Software: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-44961Oct 11, 2023Koha CommunityEPSS 1.44%

  SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.