CVE-2025-22954: Koha

Critical severity, CVSS 10.0. EPSS: 25.6% chance of exploitation in the next 30 days.

GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.

Affected products

• Koha Koha: before 24.11.02 (fixed in 24.11.02)

Published 2025-03-12. Last modified 2026-06-17.