CVE-2026-107083
CriticalCVSS 9.8Summary
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
Risk Assessment
The vulnerability may allow an attacker to gain unauthorized access to, modify, or disclose database data, posing a serious risk to the confidentiality and integrity of the library system.
Recommendation
Update SLiMS to a patched version or apply the vendor fix; until then, restrict access to the reporting module and validate the fileID parameter.
Other vulnerabilities in SLiMS
See all- CVE-2026-107082Unknown
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
- CVE-2026-107081Unknown
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints in SLiMS Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
- CVE-2025-65233Medium
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Original NVD description (English source)
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS