SQL Injection

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.CVE-2025-22954Koha · CVSS 10 · 26% likely

   CWE-89

2. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute…CVE-2015-4633Koha · 6.2% likely

   CWE-89

3. The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not…CVE-2014-1924Koha · 2.0% likely

   CWE-89

4. SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, an…CVE-2014-1925Koha · 2.0% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.