174 matches found
Slims9 Bulian 9.4.2 - SQL Injection
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. id: CVE-2021-45793 info: name: Slims9 Bulian 9.4.2 - SQL Injection author: nblirwn severity: high description: | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data c...
CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-107081: Undefined Security Weakness
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-107081
The SENAYAN Library Management System (SLiMS) Bulian 9.8.0 is vulnerable to SQL injection via identifier injection in three admin AJAX endpoints: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. The root cause is the direct interpolation of tableName ...
PT-2026-117452
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAX lookup handler.php, admin/AJAX check id.php, admin/AJAX vocabolary control.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to...
PT-2026-117517
Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loan history maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data...
CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-107084
Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...
EUVD-2026-104452
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
Senayan Library Management System v9.5.2 (Bulian) - Cross-Site Scripting Detection
SLiMS 9.5.2 Bulian vulnerable to Cross-Site Scripting in index.php. When injected, website will execute the payload repeatedly !/usr/bin/env python3 -- coding: utf-8 -- """SLiMS 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...
Slims CMS - Detect
Detects Senayan Library Management System SLiMS CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Senayan Library Management System SLiMS CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Slims CMS - Detect...
Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting Detection
SLIMS 9 was discovered to contain destination request parameter that copies the value of an HTML tag attribute which is encapsulated in double quotation marks. !/usr/bin/env python3 -- coding: utf-8 -- """SLIMS 9 was discovered to contain destination request parameter that copies the value of an...
Senayan Library Management System v8.3.1 (Akasia) - Cross-Site Scripting Detection
SLiMS 8.3.1 Akasia has a destination parameter that is vulnerable to reflected XSS. However, ensure that the p parameter points to the 'member'. Additional google dork 'intext:"SLiMS 8.3.1 Akasia"'. !/usr/bin/env python3 -- coding: utf-8 -- """SLiMS 8.""" from kittysploit import from...
CVE-2022-50805
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2022-50805 Senayan Library Management System 9.0.0 - SQL Injection
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2022-50805
Senayan Library Management System 9.0.0 (SLiMS) contains a SQL injection in the value of the class parameter. The root cause is unsafely constructed SQL queries that allow crafted payloads to manipulate database queries, potentially exfiltrating sensitive information. Exploitation is described as...
CVE-2022-50805 Senayan Library Management System 9.0.0 - SQL Injection
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2022-50805: Improper Neutralization of Special Elements used in an SQL Command
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
PT-2026-2362
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
