An authenticated remote attacker with administrator privileges can inject arbitrary JavaScript into the item type check‑in message field via the item type administration page in Koha Library Management System versions 0 through 25.11. Because the application stores the input without proper escaping, the script runs whenever other users view the page, enabling attacks such as session hijacking, defacement, or data exfiltration. This is identified by CWE‑79.

The vulnerability exists in Koha Library Management System versions up to and including 25.11. Any deployment that uses the item type administration page and grants administrators the ability to edit the check‑in message field is affected. No other vendor or product information is listed.

The CVSS score is 5.4 and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation at present. However, because the attack requires administrator privileges, the risk mainly applies to systems where such accounts are accessible over the network or from compromised local machines. Administrative access could be used to inject the stored script to compromise other users who view the page, but the overall exploitation probability remains moderate in the absence of broader exposure.