April 2026 - Koha-bugs - lists.koha-community.org

[Bug 35290] [CVE-2023-44961] SQL Injection vulnerability in ysearch.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35290 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection vulnerability |[CVE-2023-44961] SQL |in ysearch.pl |Injection vulnerability in | |ysearch.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35291] [CVE-2023-44962] File Upload vulnerability in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35291 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|File Upload vulnerability |[CVE-2023-44962] File |in upload-cover-image.pl |Upload vulnerability in | |upload-cover-image.pl -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 34761] Stored/reflected XSS with searches and saved search filters
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34761 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ulmerdan(a)yahoo.com --- Comment #15 from David Cook <dcook(a)prosentient.com.au> --- *** Bug 36089 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37727] [CVE-2024-24337] Fix CSV formula injection - client side (DataTables)
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37727 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2024-24337 - Fix CSV |[CVE-2024-24337] Fix CSV |formula injection - client |formula injection - client |side (DataTables) |side (DataTables) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34349] [CVE-2024-28739] Validate inputs for task scheduler
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34349 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Validate inputs for task |[CVE-2024-28739] Validate |scheduler |inputs for task scheduler -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 36818] [CVE-2024-36057] Remote-Code-Execution (RCE) in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36818 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Remote-Code-Execution (RCE) |[CVE-2024-36057] |in upload-cover-image.pl |Remote-Code-Execution (RCE) |(CVE-2024-36057) |in upload-cover-image.pl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 36520] [CVE-2024-36058] SQL Injection in opac-sendbasket.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36520 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection in |[CVE-2024-36058] SQL |opac-sendbasket.pl |Injection in |(CVE-2024-36058) |opac-sendbasket.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 41593] New: Authenticated SQL Injection in Koha staff interface allows full database compromise
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41593 Bug ID: 41593 Summary: Authenticated SQL Injection in Koha staff interface allows full database compromise Initiative type: --- Sponsorship Seeking sponsor status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: shukrulloh70(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org An authenticated SQL Injection vulnerability was identified in the Koha staff interface. A low-privileged staff user can inject arbitrary SQL queries via a vulnerable request parameter processed by the GetDistinctValues functionality. The injection occurs due to unsafe handling of user-supplied input when constructing SQL queries without sufficient sanitization or strict validation. Successful exploitation allows an authenticated attacker to fully compromise the backend database. /cgi-bin/koha/suggestion/suggestion.pl displayby vulnerebl parameter -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 21

[Bug 39882] New: Add phone number masking option
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39882 Bug ID: 39882 Summary: Add phone number masking option Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org It would be nice it we should add a mask for phone number fields. For certain things, like Twilio, it is important that a phone number gets set in an exact format. We have Maskito for date entry, we might be able to leverage that for phone numbers: https://maskito.dev/recipes/phone -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 30

[Bug 41636] New: Make sms_number_help text customizable
by bugzilla-daemon＠bugs.koha-community.org 08 Apr '26

08 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41636 Bug ID: 41636 Summary: Make sms_number_help text customizable Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Staff interface Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com When adding/editing a patron there is a hint next to the SMS number field: "Please enter numbers only. Prefix the number with + or 00 if including the country code." That ins't always necessarily true. This should be an HTML customization. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 6