CVE Feed

    Dashboard / CVE / CVE-2025-26200

    CVE-2025-26200

    SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.

    Published:Feb 24, 2025
    Last Modified:May 1, 2025
    EPS:Feb 24, 2025
    EPSS Score:0.00119
    CVSS Score:7.2

    Affected Products

    Vendor
    Slims
    Product
    Senayan Library Management System

    Exploits

    https://github.com/slims/slims9_bulian/issues/269https://mebroccoli.blogspot.com/2025/02/cve2.html

    Related CVEs

    CVE-2022-50805 (CVSS 8.8) — Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that a…
    CVE-2025-61488 (CVSS 7.6) — An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arb…
    CVE-2024-25288 (CVSS 4.9) — SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabo…
    CVE-2023-45996 (CVSS 8.8) — SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote…
    CVE-2023-3744 (CVSS 9.9) — Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authentica…
    CVE-2023-40970 (CVSS 8.8) — Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/cir…
    CVE-2023-40969 (CVSS 6.1) — Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) v…
    CVE-2023-29850 (CVSS 7.5) — SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This al…
    CVE-2022-45019 (CVSS 7.5) — SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.…
    CVE-2022-43362 (CVSS 7.2) — Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collT…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High