CVE-2026-70372

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-703738.8Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several us CVE-2026-703748.8HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.CVE-2026-703758.8HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in s CVE-2026-703769.6Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every CVE-2026-703777.5imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no u CVE-2026-703787.5imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative rati CVE-2026-703796.5When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTP CVE-2026-70383.3A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component C CVE-2026-703805.3A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauth CVE-2026-703815.3An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be CVE-2026-703824.1Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker wh CVE-2026-703838.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA)