VulnerabilityDeferred

CVE-2025-52360

A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05.

HIGH 8.8EPSS 0.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: cve@mitre.org

References

https://gist.github.com/MerttTuran/32289a1d3c173f0b7934237c1696bef1

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.