CVE-2015-4633

9.8 criticalEPSS 6.1%

Critical (9.8) in koha koha. EPSS 6.1% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2018-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

koha:koha

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14412
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14426
https://koha-community.org/koha-3-14-16-released/
https://koha-community.org/security-release-koha-3-16-12/
https://koha-community.org/security-release-koha-3-18-8/

Check your stack JSON