CVE-2026-70373

Koha: SQL Injection in reports/issues_stats.pl. The circulation statistics report builds its calculation query by concatenating user-controlled parameters (PeriodTypeSel, PeriodDaySel, PeriodMonthSel, Filter/Line/Column identifiers) into the SQL, allowing an authenticated staff user with the repo...