CVE-2015-4639

Severity CVSS v4.0:
Pending analysis
Type:
CWE-352 Cross-Site Request Forgery (CSRF)
Publication date:
21/07/2017
Last modified:
20/04/2025

Description

Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:koha:koha:3.14.00:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.00:alpha1:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.00:alpha2:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.00:beta:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.01:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.02:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.03:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.04:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.05:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.06:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.07:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.08:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.09:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.10:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:3.14.11:*:*:*:*:*:*:*