Ctrlk

**Name of the Vulnerable Software and Affected Versions** Koha Library Management System versions 0 through 25.11 **Description** A stored cross-site scripting (XSS) issue exists in the patron restriction type administration page. An authenticated remote attacker with administrator privileges can inject arbitrary web scripts through the restriction type label, specifically using the `display text` field. **Recommendations** Update Koha Library Management System to a version later than 25.11. As a temporary mitigation, restrict access to the patron restriction type administration page or avoid modifying the `display text` field.

**Name of the Vulnerable Software and Affected Versions** Koha Library Management System versions 0 through 25.11 **Description** A stored cross-site scripting (XSS) issue exists in the item type administration page. An authenticated remote attacker with administrator privileges can inject arbitrary web scripts through the `checkinmsg` field. Stored XSS occurs when a malicious script is permanently stored on the target server and later executed in the browser of another user. **Recommendations** Update Koha Library Management System to a version later than 25.11. As a temporary mitigation, restrict administrative access to the item type administration page and avoid entering untrusted content into the `checkinmsg` field.