CVE-2025-30076

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
KohaKoha< 22.11.24; >= 23, < 23.11.12; >= 24, < 24.05.07; >= 24.06, < 24.11.02

References

Timeline

Published
Mar 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-300776.2Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of CVE-2025-30085.5A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/CVE-2025-300807.5Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary dCVE-2025-300846.1A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard componenCVE-2025-300859.2Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submissionCVE-2025-300864.9CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak presenCVE-2025-300876.1Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.CVE-2025-300895.4gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.CVE-2025-30096.3A vulnerability classified as critical was found in Jinher Network OA C6. Affected by this vulnerability is an unknown functionality of the CVE-2025-300907.2mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript CVE-2025-300919.4In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated aCVE-2025-300926.1Intrexx Portal Server 12.x <= 12.0.2 and 11.x <= 11.9.2 allows XSS in multiple Velocity scripts.
CVE-2025-30076: High severity, CVSS 7.7 | Vulnix