140 matches found
CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
Slims9 Bulian 9.4.2 - SQL Injection
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. id: CVE-2021-45793 info: name: Slims9 Bulian 9.4.2 - SQL Injection author: nblirwn severity: high description: | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data c...
PT-2026-117452
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAX lookup handler.php, admin/AJAX check id.php, admin/AJAX vocabolary control.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to...
EUVD-2026-104452
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-107081
The SENAYAN Library Management System (SLiMS) Bulian 9.8.0 is vulnerable to SQL injection via identifier injection in three admin AJAX endpoints: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. The root cause is the direct interpolation of tableName ...
Senayan Library Management System v9.5.2 (Bulian) - Cross-Site Scripting Detection
SLiMS 9.5.2 Bulian vulnerable to Cross-Site Scripting in index.php. When injected, website will execute the payload repeatedly !/usr/bin/env python3 -- coding: utf-8 -- """SLiMS 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...
CVE-2022-50805
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2022-50805 Senayan Library Management System 9.0.0 - SQL Injection
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2022-50805: Improper Neutralization of Special Elements used in an SQL Command
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
PT-2026-2362
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive...
CVE-2023-40970
Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loanrules.php...
CVE-2023-40969
Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery SSRF via admin/modules/bibliography/popp2p.php...
EUVD-2025-203916
Reflected cross-site scripting XSS in SLiMS slims9bulian before 9.6.0 via improper handling of $SERVER'PHPSELF' in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path...
EUVD-2025-35092
An issue in Senayan Library Management System SLiMS 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrapimage.php component and the imageURL parameter...
CVE-2025-61488
An issue in Senayan Library Management System SLiMS 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrapimage.php component and the imageURL parameter...
PT-2025-42799
Name of the Vulnerable Software and Affected Versions Senayan Library Management System SLiMS 9 Bulian version 9.6.1 Description An issue exists in Senayan Library Management System SLiMS 9 Bulian version 9.6.1 that allows a remote attacker to execute arbitrary code. The issue is related to the...
CVE-2025-61488: Improper Control of Generation of Code
An issue in Senayan Library Management System SLiMS 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrapimage.php component and the imageURL parameter...