Total vulnerabilities in the database
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl.
| Software | From | Fixed in |
|---|---|---|
| koha / koha | 3.18.1 | 3.18.1.x |
| koha / koha | 3.18.0 | 3.18.0.x |
| koha / koha | - | 3.16.05.x |