SLiMS vulnerabilities
4 known CVE vulnerabilities in SLiMS, translated and rated.
- CVE-2026-107082Unknown
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
- CVE-2026-107081Unknown
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints in SLiMS Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
- CVE-2026-107083Critical
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- CVE-2025-65233Medium
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS