G03M0N

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features

**Name of the Vulnerable Software and Affected Versions** Koha versions prior to 25.11 **Description** A Server-Side Request Forgery (SSRF) issue exists via the Z39.50/SRU server configuration, which allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times. Additionally, the Z39.50 configuration module may allow a remote attacker to execute arbitrary code. **Recommendations** Update to a version later than 25.11. Restrict access to the Z39.50 configuration module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Koha versions 25.11 and earlier **Description** A Cross Site Scripting issue exists in Koha. A remote attacker may be able to execute arbitrary code through the News function. The issue allows for the injection of malicious scripts into web pages viewed by other users. The vulnerable component is the News function. **Recommendations** Update to a version of Koha later than 25.11.

**Name of the Vulnerable Software and Affected Versions** Ruoyi versions 4.7.9 and earlier **Description** A cross-site scripting (XSS) issue was discovered in Ruoyi via the `sql` parameter of the `createTable()` function at "/tool/gen/create". This allows for potential exploitation. **Recommendations** For versions 4.7.9 and earlier, as a temporary workaround, consider disabling the `createTable()` function until a patch is available. Restrict access to the "/tool/gen/create" endpoint to minimize the risk of exploitation. Avoid using the `sql` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.