Zero Radar
← feed
CriticalVulnerabilityCVE-2026-107081updated 25 Oct 2026, 15:20 UTC

SLiMS library system: staff can extract database contents

Any logged-in library staff member could trick the system into revealing data it should keep hidden, including records stored in its database. Attackers could read or copy that data.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Staff loginAttacker has any valid staff account
  2. 2Admin AJAX requestSends crafted tableName or tableFields value
  3. 3Injected queryUnsanitized input reaches the database
  4. 4Data extractedArbitrary database contents returned
  5. ResultAttacker reads the full database

What happened

SQL injection via the tableName and tableFields POST parameters in admin AJAX endpoints (AJAX_lookup_handler.php, AJAX_check_id.php, AJAX_vocabolary_control.php) of SENAYAN Library Management System (SLiMS) Bulian 9.8.0.

Why it is dangerous: An authenticated staff account can extract arbitrary database contents, which may include member and staff data. Libraries running SLiMS are at risk, especially where many people hold staff logins.

Are you affected?

You are affected if you run SENAYAN Library Management System (SLiMS) Bulian 9.8.0 and any staff user can log in to the admin area.

SENAYAN Library Management System (SLiMS) Bulian 9.8.0

What to do

  1. Check whether you run SLiMS Bulian 9.8.0
  2. Restrict admin access to trusted staff only and review staff accounts
  3. Watch for an official SLiMS update or patch and apply it when released

Timeline

  1. 19 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 19 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-107081 · GHSA-mpf7-wfh6-9gg6
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
19 Oct 2026, 16:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SLiMS library system: staff can extract database contents · Zero Radar