https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T17:06:58.357814+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-70369 CVE-2026-70369 — Koha - SQL Injection in reports/acquisitions_stats.pl 2026-10-09T17:06:58.376765+00:00

Affected: Koha Community Koha

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.