CVE Feed

    Dashboard / CVE / CVE-2023-29850

    CVE-2023-29850

    SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.

    Published:Apr 14, 2023
    Last Modified:Feb 6, 2025
    EPS:Apr 14, 2023
    EPSS Score:0.00193
    CVSS Score:7.5

    Affected Products

    Vendor
    Slims
    Product
    Senayan Library Management System

    Exploits

    https://github.com/slims/slims9_bulian/issues/186https://github.com/slims/slims9_bulian/issues/186

    Common Weakness Enumeration

    CWE-203 Observable Discrepancy

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-189 Black Box Reverse Engineering

    Related CVEs

    CVE-2022-50805 (CVSS 8.8) — Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that a…
    CVE-2025-61488 (CVSS 7.6) — An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arb…
    CVE-2025-26200 (CVSS 7.2) — SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the …
    CVE-2024-25288 (CVSS 4.9) — SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabo…
    CVE-2023-45996 (CVSS 8.8) — SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote…
    CVE-2023-3744 (CVSS 9.9) — Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authentica…
    CVE-2023-40970 (CVSS 8.8) — Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/cir…
    CVE-2023-40969 (CVSS 6.1) — Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) v…
    CVE-2022-45019 (CVSS 7.5) — SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.…
    CVE-2022-43362 (CVSS 7.2) — Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collT…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High