AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-70370

HIGH · CVSS 8.8 EPSS 0.31%

Source: NVD + CISA KEV + EPSS · Published 2026-08-04 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

Koha's reports/catalogue_stats.pl is vulnerable due to improper handling of user-controlled parameters in SQL queries, allowing authenticated staff users with reports module permissions to perform SQL injection attacks. This vulnerability can lead to unauthorized access to sensitive data, including borrower information, password hashes, and API keys. Organizations using Koha should prioritize addressing this issue to protect their database integrity and user privacy.

CVE
CVE-2026-70370
Severity
HIGH
CVSS
8.8
EPSS
0.31%

Original NVD Description

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.