CVE-2025-22954criticalCWE-89

CVE-2025-22954: critical vulnerability in Koha

Published · Updated

Follow this CVE+ Monitor Koha

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 26%
from disclosure to weapon7 days
Published on NVDMar 12
1st PoC+7d
GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Koha · Koha
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Koha

In the same product, most dangerous first.

CVE-2026-19780HIGHKoha Eval Code Injection Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-30076HIGHCVE-2025-30076EPSS 0.4%