SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.

Last Modified: Oct 22, 2026

Published: Oct 19, 2026

CVE-2026-107084

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.

Last Modified: Oct 27, 2026

Published: Oct 19, 2026

CVE-2026-107082

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

Last Modified: Oct 21, 2026

Published: Oct 19, 2026

CVE-2026-107083

SQL Injection in SLiMS Bulian Reporting Module

Last Modified: Oct 21, 2026

Published: Oct 19, 2026

CVE-2022-50805

Senayan Library Management System 9.0.0 - SQL Injection

Last Modified: Apr 15, 2026

Published: Jan 13, 2026

Items Per Page