VULNERABILITY INTELLIGENCE
CVE-2026-70370
CVSS score8.8 HIGH
EPSS probability0.57%
CISA KEVNot currently listed
Published2026-08-04
Last modified2026-10-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
Weakness classification
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c: CWE-89