CVE-2015-4639

Published: Jul 21, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.

Affected (36)

Products: Koha: Koha

Koha

1 product

Koha

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Koha Koha	Version 3.14.00
Koha Koha	Version 3.14.00 alpha1
Koha Koha	Version 3.14.00 alpha2
Koha Koha	Version 3.14.00 beta
Koha Koha	Version 3.14.01
Koha Koha	Version 3.14.02
Koha Koha	Version 3.14.03
Koha Koha	Version 3.14.04
Koha Koha	Version 3.14.05
Koha Koha	Version 3.14.06
Koha Koha	Version 3.14.07
Koha Koha	Version 3.14.08
Koha Koha	Version 3.14.09
Koha Koha	Version 3.14.10
Koha Koha	Version 3.14.11
Koha Koha	Version 3.14.12
Koha Koha	Version 3.14.13
Koha Koha	Version 3.14.14
Koha Koha	Version 3.14.15
Koha Koha	Version 3.16.00
Koha Koha	Version 3.16.00 beta
Koha Koha	Version 3.16.00 pkg
Koha Koha	Version 3.16.00 rc
Koha Koha	Version 3.16.01
Koha Koha	Version 3.16.02
Koha Koha	Version 3.16.03
Koha Koha	Version 3.16.04
Koha Koha	Version 3.16.05
Koha Koha	Version 3.16.06
Koha Koha	Version 3.16.07
Koha Koha	Version 3.16.08
Koha Koha	Version 3.16.09
Koha Koha	Version 3.16.10
Koha Koha	Version 3.16.11
Koha Koha	Version 3.20.00
Koha Koha	Version 3.20.00 beta