CVE-2026-6428
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter
SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Koha
- Vendor
- Koha Community
- Product
- Koha
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://koha-community.org/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | Unavailable | 22.11.38 | None listed |
| 23.05.00 | affected | semver | Unavailable | 23.11.15 | None listed |
| 24.05.00 | affected | semver | Unavailable | 24.11.16 | None listed |
| 25.05.00 | affected | semver | Unavailable | 25.05.11 | None listed |
| 25.11.00 | affected | semver | Unavailable | 25.11.05 | None listed |
| 26.05.00 | affected | semver | Unavailable | 26.05.01 | None listed |