Yüksek CVSS 8.8
CVE-2026-70370: CVE-2026-70370: SQL enjeksiyonu
Açıklama (NVD)
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
Özet bilgiler
- CVSS v3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,57 (yüzdelik 47)
- CWE
- CWE-89
- Yama
- Yok / bilinmiyor