PT-2025-30837 · Koha · Library Management System

Published 2025-07-25 · Updated 2025-07-30 · CVE-2025-52360

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Koha Library Management System version 24.05

Description A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when a user interacts with the interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52360

Affected Products

Library Management System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-52360 · Security Note
• https://twitter.com/cracbot/status/1950511758470258695 · Twitter Post
• https://twitter.com/CVEnew/status/1948755370068865383 · Twitter Post
• https://gist.github.com/MerttTuran/32289a1d3c173f0b7934237c1696bef1 · Note