Filtered by vendor Slims Subscriptions
Filtered by product Slims 9 Bulian Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-107081 1 Slims 1 Slims 9 Bulian 2026-10-22 9.8 Critical
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
CVE-2026-107082 1 Slims 1 Slims 9 Bulian 2026-10-21 8.8 High
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
CVE-2026-107083 1 Slims 1 Slims 9 Bulian 2026-10-21 9.8 Critical
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
CVE-2026-107084 1 Slims 1 Slims 9 Bulian 2026-10-21 N/A
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.
CVE-2025-65233 2 Slims, Slims Project 2 Slims 9 Bulian, Slims 2026-01-05 6.1 Medium
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.