CVE-2026-31844Disclosure(koha / koha)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

koha CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

koha

Threat summary

5 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 1d ago at 4 mentions (2026-03-11); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

koha

Products

koha

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 2d

Signal classification1 categories

Disclosure

5100.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	4	Disclosure4
2026-03-15	1	Disclosure1

Full discourse5 posts

Vulmon Vulnerability Feed@VulmonFeeds213d
Disclosure
CVE-2026-31844 SQL Injection in Koha Staff Interface via Suggestion Endpoint Displayby Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31844
Post summary
The post announces CVE‑2026‑31844, detailing a SQL injection flaw in the Koha staff interface’s suggestion endpoint through the displayby parameter.
0001017
4.0K followersView on X
CVE@CVEnew209d
Disclosure
CVE-2026-31844 An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper valida… https://www.cve.org/CVERecord?id=CVE-2026-31844
Post summary
The post discloses an authenticated SQL injection flaw in Koha’s staff interface, identifying the vulnerable endpoint and CWE, but it does not provide any PoC, exploit, or patch information.
00000159
56.7K followersView on X
The Hacker Wire@TheHackerWire213d
Disclosure
🟠 CVE-2026-31844 - High An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby par... https://www.thehackerwire.com/vulnerability/CVE-2026-31844/ https://t.co/DThdxnsPim
Post summary
The tweet announces a high‑severity authenticated SQL injection vulnerability (CWE‑89) in the Koha staff interface, providing endpoint details but no PoC, exploit, or mitigation.
0000033
134 followersView on X
CVEFind.com@CveFindCom213d
Disclosure
[CVE-2026-31844: HIGH] Critical SQL Injection vulnerability (CWE-89) in Koha's http://suggestion.pl allows low-privileged staff users to retrieve sensitive data via authenticated malicious queries.#cve,CVE-2026-31844,#cybersecurity https://cvefind.com/CVE-2026-31844
Post summary
The post announces a high‑severity SQL injection vulnerability (CVE-2026-31844) in Koha's suggestion.pl that allows low‑privileged authenticated users to retrieve sensitive data.
0000049
600 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash213d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-31844 - Authenticated SQL Injection in Koha displayby parameter of http://suggestion.pl Intel Report: https://ift.tt/mU3dW5g
Post summary
An authenticated SQL injection vulnerability (CVE-2026-31844) in the 'displayby' parameter of Koha indicates a new threat, with technical details provided but no PoC or evidence of exploitation.
0000031
343 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	koha	koha	-	-	-
App	koha	koha	25.11.00	-	-

Explore more

Back to dashboard koha CVEs koha vulnerabilities

What researchers are saying

CVE-2026-31844

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑31844, detailing a SQL injection flaw in the Koha staff interface’s suggestion endpoint through the displayby parameter.

CVE@CVEnewDisclosure

The post discloses an authenticated SQL injection flaw in Koha’s staff interface, identifying the vulnerable endpoint and CWE, but it does not provide any PoC, exploit, or patch information.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a high‑severity authenticated SQL injection vulnerability (CWE‑89) in the Koha staff interface, providing endpoint details but no PoC, exploit, or mitigation.

CVEFind.com@CveFindComDisclosure

The post announces a high‑severity SQL injection vulnerability (CVE-2026-31844) in Koha's suggestion.pl that allows low‑privileged authenticated users to retrieve sensitive data.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

An authenticated SQL injection vulnerability (CVE-2026-31844) in the 'displayby' parameter of Koha indicates a new threat, with technical details provided but no PoC or evidence of exploitation.