An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validat…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 11, 2026 · NIST NVD

   Detected

   An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

2. Aug 10, 2026 · NIST NVD

   Updated

   An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

Affected

• cpe koha/kohaversion unspecified
• cpe koha/koha25.11.00

Sources

• CVE.orgVulnerability recordCVE-2026-31844

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31844

  An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to f

  nvd.nist.gov

References

• Issue Tracking · bugs.koha-community.org
• Not Applicable · koha-community.gitlab.io
• Release Notes · koha-community.org