CVEvulnerability

CVE-2026-6428

5.6 MEDIUM Published 2026-06-13 Modified 2026-08-10 Official page ↗
Status
Awaiting Analysis
Published
2026-06-13
Last modified
2026-08-10
Assigner
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
CVSS 4.0 (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)
5.6 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber
CVSS 3.1 (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS 2.0 (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)
7.5 HIGH — AV:N/AC:L/Au:S/C:C/I:N/A:P
Weaknesses
CWE-89

Description

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References