Back to Database
Status published
Medium
CVE-2014-9446
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in...
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha before 3.16.6 and 3.18.x before 3.18.2 allow remote attackers to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9446
Credits & Attribution
No credits recorded in the NVD database.
References
More from koha
View All →CVE-2018-1000670
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x...
Medium
6.1
CVE-2018-1000669
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x...
High
8.8
CVE-2015-4639
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before...
High
8.8
CVE-2015-4633
Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x...
Critical
9.8
CVE-2015-4632
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x...
High
7.5
Affected Vendor
koha
View all reports →Affected Software
koha
Vulnerable Versions:
0, 3.18.0, 3.18.1
Timeline
Official Publish:
January 2nd, 2015
Last Modified:
September 16th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.