CVE-2021-45794

Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained...

CVE-2021-45792

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting XSS in /admin/modules/system/customfield.php...

CVE-2021-45792

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting XSS in /admin/modules/system/customfield.php...

CVE-2021-45791

CVE-2021-45791 affects Slims8 Akasia 8.3.1. A SQL injection exists in multiple admin modules (bibliography, member_type, user_group, membership index) via the dir parameter, due to insufficient input escaping/validation. Exploitation is described as feasible by remotely authenticated librarian us...

CVE-2021-45792: Improper Neutralization of Input During Web Page Generation

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting XSS in /admin/modules/system/customfield.php...

PT-2022-12411

Name of the Vulnerable Software and Affected Versions Slims9 Bulian version 9.4.2 Description The issue affects the "/admin/modules/system/backup.php" API endpoint, allowing SQL injection attacks. This can result in the unauthorized obtainment of user data. Recommendations For Slims9 Bulian versi...

PT-2022-12409

Name of the Vulnerable Software and Affected Versions Slims9 Bulian version 9.4.2 Description The issue is related to Cross Site Scripting XSS in the "/admin/modules/system/custom field.php" API endpoint. This affects the ability to securely manage custom fields within the system. Recommendations...

CVE-2017-12584

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...

PT-2017-12588

Name of the Vulnerable Software and Affected Versions SLiMS versions 8 Akasia through 8.3.1 Description The issue allows remote attackers to perform a complete account takeover by tricking a user into changing their password to an attacker-controlled one. This is possible because there is no CSRF...