CVE-2026-41921

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41921", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-22T18:50:43.619Z", "datePublished": "2026-08-18T21:09:48.910Z", "dateUpdated": "2026-10-01T15:20:00.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:00.430Z"}, "title": "Koha Stored XSS via Purchase Suggestion Handler", "descriptions": [{"lang": "en", "value": "Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions."}], "datePublic": "2026-08-04T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "26.05.0", "versionType": "custom", "lessThan": "26.05.02"}, {"status": "affected", "version": "25.11.0", "versionType": "custom", "lessThan": "25.11.07"}, {"status": "affected", "version": "25.05.0", "versionType": "custom", "lessThan": "25.05.13"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.05.0", "versionEndExcluding": "26.05.02"}, {"vulnerable": true, "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.11.0", "versionEndExcluding": "25.11.07"}, {"vulnerable": true, "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.05.0", "versionEndExcluding": "25.05.13"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "references": [{"url": "https://koha-community.org/koha-26-05-02-released/", "name": "v26.05.02 Release Notes", "tags": ["release-notes"]}, {"url": "https://koha-community.org/koha-25-11-07-released/", "name": "v25.11.07 Release Notes", "tags": ["release-notes"]}, {"url": "https://koha-community.org/koha-25-05-13-released/", "name": "v25.05.13 Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alex Williams from Pellera Technologies", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:15:29.766744Z", "id": "CVE-2026-41921", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:15:42.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:15:29.766744Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:15:37.436Z"}}], "cna": {"title": "Koha Stored XSS via Purchase Suggestion Handler", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alex Williams from Pellera Technologies"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Koha Community", "product": "Koha", "versions": [{"status": "affected", "version": "26.05.0", "lessThan": "26.05.02", "versionType": "custom"}, {"status": "affected", "version": "25.11.0", "lessThan": "25.11.07", "versionType": "custom"}, {"status": "affected", "version": "25.05.0", "lessThan": "25.05.13", "versionType": "custom"}], "defaultStatus": "affected"}], "datePublic": "2026-08-04T00:00:00.000Z", "references": [{"url": "https://koha-community.org/koha-26-05-02-released/", "name": "v26.05.02 Release Notes", "tags": ["release-notes"]}, {"url": "https://koha-community.org/koha-25-11-07-released/", "name": "v25.11.07 Release Notes", "tags": ["release-notes"]}, {"url": "https://koha-community.org/koha-25-05-13-released/", "name": "v25.05.13 Release Notes", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.05.02", "versionStartIncluding": "26.05.0"}, {"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "25.11.07", "versionStartIncluding": "25.11.0"}, {"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "25.05.13", "versionStartIncluding": "25.05.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T15:20:00.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41921", "state": "PUBLISHED", "dateUpdated": "2026-10-01T15:20:00.430Z", "dateReserved": "2026-04-22T18:50:43.619Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-18T21:09:48.910Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Koha", "vendor": "Koha Community", "versions": [{"lessThan": "26.05.02", "status": "affected", "version": "26.05.0", "versionType": "custom"}, {"lessThan": "25.11.07", "status": "affected", "version": "25.11.0", "versionType": "custom"}, {"lessThan": "25.05.13", "status": "affected", "version": "25.05.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions."}, {"lang": "es", "value": "Koha antes de 26.05.02, 25.11.07 y 25.05.13 contiene una vulnerabilidad de cross-site scripting almacenado en el gestor de sugerencias de compra que permite a los usuarios de personal autenticados inyectar scripts maliciosos al enviar entrada no saneada a trav\u00e9s de la operaci\u00f3n de guardar sugerencia. Los atacantes pueden proporcionar contenido HTML o de script manipulado en campos como t\u00edtulo, autor, isbn, c\u00f3digo de editor, lugar, t\u00edtulo de colecci\u00f3n, tipo de art\u00edculo y nota, que se almacenan sin saneamiento y se renderizan posteriormente en la plantilla de lista de sugerencias, haciendo que los scripts inyectados se ejecuten en el navegador de cualquier usuario de personal que vea las sugerencias."}], "id": "CVE-2026-41921", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41921", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:15:29.766744Z", "version": "2.0.3"}}]}, "published": "2026-08-18T21:16:34.487", "references": [{"source": "disclosure@vulncheck.com", "url": "https://koha-community.org/koha-25-05-13-released/"}, {"source": "disclosure@vulncheck.com", "url": "https://koha-community.org/koha-25-11-07-released/"}, {"source": "disclosure@vulncheck.com", "url": "https://koha-community.org/koha-26-05-02-released/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/koha-stored-xss-via-purchase-suggestion-handler"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.05.0,26.05.02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.11.0,25.11.07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.05.0,25.05.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Koha", "source": "cna", "vendor": "Koha Community"}, "product": "koha", "vendor": "koha-community"}], "created": "2026-08-18T23:00:13.465684+00:00", "updated": "2026-08-19T09:30:03.684272+00:00", "vendors": ["koha-community", "koha-community$PRODUCT$koha"]}