CVE-2026-70373 Koha: SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

CVE-2026-70373

Koha: SQL Injection in reports/issues_stats.pl. The circulation statistics report builds its calculation query by concatenating user-controlled parameters (PeriodTypeSel, PeriodDaySel, PeriodMonthSel, Filter/Line/Column identifiers) into the SQL, allowing an authenticated staff user with the repo...