A reflected cross‑site scripting flaw exists in the News function of Koha library management system up to and including version 25.11. An unauthenticated attacker can craft a request or URL that injects malicious JavaScript into the News page. When an end‑user views the page, the script runs with the browser context of that user, allowing execution of arbitrary code, theft of session data, defacement, or further compromise of the user’s system. The weakness is identified as CWE‑79.

Koha library management system, versions 25.11 and earlier.

The CVSS score of 5.4 indicates moderate severity, while an EPSS value of less than 1% suggests exploitation is currently unlikely but still possible. Because the vulnerability is remotely exploitable without authentication, any visitor to a vulnerable Koha site could be compromised. The flaw has not yet appeared in the CISA KEV catalog but is publicly documented, so attentive attackers could target unpatched installations. Implementing mitigations such as updating the software or applying defense‑in‑depth controls is recommended to prevent potential exploitation.