- Koha-bugs - lists.koha-community.org

[Bug 14426] [CVE-2015-4633] SQL Injection in Staff Client
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426 Martin Renvoize (ashimema) <martin.renvoize(a)openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|Oldversions |--- David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook(a)prosentient.com.au Summary|SQL Injection in Staff |[CVE-2015-4633] SQL |Client |Injection in Staff Client -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 14416] [CVE-2015-4639] Stored XSS flaw affects OPAC and Staff interface
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Stored XSS flaw affects |[CVE-2015-4639] Stored XSS |OPAC and Staff interface |flaw affects OPAC and Staff | |interface CC| |dcook(a)prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19117] [CVE-2018-1000669] paycollect.pl is vulnerable for CSRF attacks
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook(a)prosentient.com.au Summary|paycollect.pl is vulnerable |[CVE-2018-1000669] |for CSRF attacks |paycollect.pl is vulnerable | |for CSRF attacks -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 19086] [CVE-2018-1000670] Multiple cross-site scripting vulnerabilities
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19086 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Multiple cross-site |[CVE-2018-1000670] Multiple |scripting vulnerabilities |cross-site scripting | |vulnerabilities CC| |dcook(a)prosentient.com.au -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 0

[Bug 19319] [CVE-2018-25101] Reflected XSS Vulnerability in opac-MARCdetail.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19319 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook(a)prosentient.com.au Summary|Reflected XSS Vulnerability |[CVE-2018-25101] Reflected |in opac-MARCdetail.pl |XSS Vulnerability in | |opac-MARCdetail.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35290] [CVE-2023-44961] SQL Injection vulnerability in ysearch.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35290 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|SQL Injection vulnerability |[CVE-2023-44961] SQL |in ysearch.pl |Injection vulnerability in | |ysearch.pl -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 35291] [CVE-2023-44962] File Upload vulnerability in upload-cover-image.pl
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35291 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|File Upload vulnerability |[CVE-2023-44962] File |in upload-cover-image.pl |Upload vulnerability in | |upload-cover-image.pl -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 0

[Bug 34761] Stored/reflected XSS with searches and saved search filters
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34761 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ulmerdan(a)yahoo.com --- Comment #15 from David Cook <dcook(a)prosentient.com.au> --- *** Bug 36089 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37727] [CVE-2024-24337] Fix CSV formula injection - client side (DataTables)
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37727 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2024-24337 - Fix CSV |[CVE-2024-24337] Fix CSV |formula injection - client |formula injection - client |side (DataTables) |side (DataTables) -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 34349] [CVE-2024-28739] Validate inputs for task scheduler
by bugzilla-daemon＠bugs.koha-community.org 09 Apr '26

09 Apr '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34349 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Validate inputs for task |[CVE-2024-28739] Validate |scheduler |inputs for task scheduler -- You are receiving this mail because: You are watching all bug changes.

1 0