CVE Feed

    Dashboard / CVE / CVE-2026-41921

    CVE-2026-41921

    Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

    Published:Aug 18, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 18, 2026
    EPSS Score:0.00298
    CVSS Score:5.4

    Affected Products

    Vendor
    Koha-community
    Product
    Koha

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-72610 (CVSS 4.3) — A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent…
    CVE-2026-72609 (CVSS 7.1) — An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated…
    CVE-2026-72608 (CVSS 6.5) — A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent…
    CVE-2026-72607 (CVSS 7.1) — A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent…
    CVE-2026-71288 (CVSS 8.8) — Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynami…
    CVE-2026-70373 (CVSS 8.8) — Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calcula…
    CVE-2026-70372 (CVSS 8.8) — Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled …
    CVE-2026-70371 (CVSS 8.8) — Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlle…
    CVE-2026-70370 (CVSS 8.8) — Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Lin…
    CVE-2026-70369 (CVSS 8.8) — Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating th…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High