CVE-2026-70373 — Koha - SQL Injection in reports/issues_stats.pl
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters dire…
Published: 2026-08-04 · CVSS: 8.8 · CVSS 3.1
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7