Dashboard / CVE-2026-70370

CVE-2026-70370

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-08-04 Modified: 2026-10-23 First seen: 2026-10-29 Status: pending_score

Description

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

Weakness Classification (1)

References & Advisories (3)

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.57%
Raw Score 0.005670
Percentile 47.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00567
2026-10-28
0.00567

Intelligence Sources

nvd ref →

External Links