Koha Library Software
Approved changes feed: RSS · Atom
cpe:2.3:a:koha-community:koha_library_software:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Koha Community (5520f932-37c1-5271-8d5b-0e5632e0d8fb) |
|---|---|
| Product | Koha Library Software (43378afc-2802-5a5a-80c6-4e4a3973f313) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/koha-community/koha |
purl2cpe | 2026-06-01 10:17:17.917257 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-24337 |
vulnerable | 2026-06-08 06:29:41.267572 |
Details available
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
Published: 2024-02-12T00:00:00.000Z
Updated: 2025-09-29T14:22:32.206Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24336 |
vulnerable | 2026-06-08 06:29:41.267079 |
Details available
A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the 'Circulation note' and ‘Patrons Restriction’ components.
Published: 2024-03-19T00:00:00.000Z
Updated: 2025-09-29T14:28:04.099Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-44962 |
vulnerable | 2026-06-08 06:12:41.556702 |
Details available
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
Published: 2023-10-11T00:00:00.000Z
Updated: 2024-09-18T16:06:41.513Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-44961 |
vulnerable | 2026-06-08 06:12:41.556304 |
Details available
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.
Published: 2023-10-11T00:00:00.000Z
Updated: 2024-09-18T16:08:25.404Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.