What’s Vulnerable › Vulnerabilities

CVE-2025-22954

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 25.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-12 · updated 2026-06-17
• Weakness: CWE-89

Description

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.

Affected products

• Koha Community Koha: before 24.11.02 — fixed in 24.11.02

How to fix

Upgrade to a fixed version: Koha Community Koha 24.11.02. Check the vendor advisory for mitigations.

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829
• https://koha-community.org/koha-24-11-02-released/

Get alerted when CVE-2025-22954 or the next vulnerability affects your stack