CVE-2026-105107

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107

The Koha library system is vulnerable to SQL injection within the reports/cat_issues_top.pl script (specifically the sub calculate function). The root cause is the direct concatenation of user-controlled Criteria , Filter , and Limit request parameters into dynamic SQL queries without adequate va...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

EUVD-2026-100898

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...