- Koha-bugs - lists.koha-community.org

[Bug 42368] [CVE-2026-70371] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42369] [CVE-2026-70372] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42735] [CVE-2026-70373] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

1 0

[Bug 42735] SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735 --- Comment #12 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70373. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42369] SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369 --- Comment #11 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70372. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42368] SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368 --- Comment #20 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70371. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42363] SQL Injection in reports/catalogue_stats.pl via the Line request parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363 --- Comment #11 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70370. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 42360] SQL Injection in reports/acquisitions_stats.pl via Filter parameter
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 --- Comment #38 from Sanjarbiy <sanjarbiy11(a)gmail.com> --- This has been assigned CVE-2026-70369. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 43224] New: Wrong op value add_item in additem.tt
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43224 Bug ID: 43224 Summary: Wrong op value add_item in additem.tt Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Target Milestone: --- There is a wrong op value "add_item" in additem.tt line 401. Value should be "cud-additem". This has probably caused some issues, but to be honest I don't really understand why we need to add hidden itemnumber to the form when we already to it in line 294. Because of this when form is now send, both itemnumbers are send to the back-end as hash. But nevertheless, value should probably be fixed. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 1

[Bug 33756] New: Wrong calculation of total amount spent?
by bugzilla-daemon＠bugs.koha-community.org 05 Aug '26

05 Aug '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33756 Bug ID: 33756 Summary: Wrong calculation of total amount spent? Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Acquisitions Assignee: koha-bugs(a)lists.koha-community.org Reporter: katrin.fischer(a)bsz-bw.de QA Contact: testopia(a)bugs.koha-community.org I am trying to work out something in acquisitions and stumbled on this bit: https://git.koha-community.org/Koha-community/Koha/src/branch/master/C4/Bud… # Get all the budgets totals in as few queries as possible my $hr_budget_spent = $dbh->selectall_hashref(q| SELECT aqorders.budget_id, aqbudgets.budget_parent_id, SUM( | . C4::Acquisition::get_rounding_sql(qq|COALESCE(unitprice_tax_included, ecost_tax_included)|) . q| * quantity ) AS budget_spent FROM aqorders JOIN aqbudgets USING (budget_id) WHERE quantityreceived > 0 AND datecancellationprinted IS NULL GROUP BY budget_id, budget_parent_id |, 'budget_id'); If the amount is spent, I feel multiplying by quantity is incorrect. It should be quantityreceived. I am not sure yet where this is used and how it manifests. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14