Ignas⌘Ctrlk

**Name of the Vulnerable Software and Affected Versions** Koha Library Management System versions 0 through 25.11 **Description** A stored cross-site scripting (XSS) issue exists in the OPAC item detail page. An authenticated remote attacker with `edit items` permission can inject arbitrary web scripts through the `items.itemnotes` field. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing the script to be executed in the browser of other users. **Recommendations** Update Koha Library Management System to a version later than 25.11. Restrict the use of the `items.itemnotes` field for users with `edit items` permission until the system is updated.