CVE-2025-26200

all versions

SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.p

7.2HIGH

CVE-2024-25288

>= 9.0.0 and <= 9.6.1

SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.

4.9MEDIUM

CVE-2023-45996

all versions

SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain

8.8HIGH

CVE-2023-3744

all versions

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send

9.9CRITICAL

CVE-2023-40970

all versions

Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.

8.8HIGH

CVE-2023-40969

all versions

Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bib

6.1MEDIUM

CVE-2023-29850

all versions

SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to ob

7.5HIGH

CVE-2022-45019

all versions

SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.

7.5HIGH

CVE-2022-43362

all versions

Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loa

7.2HIGH

CVE-2022-43361

all versions

Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component po

4.8MEDIUM

CVE-2022-38292

all versions

SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components

9.8CRITICAL

CVE-2022-38291

all versions

SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search

6.1MEDIUM

CVE-2021-45794

all versions

Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.

7.5HIGH

CVE-2021-45793

all versions

Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.

7.5HIGH

CVE-2021-45792

all versions

Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.

4.8MEDIUM

CVE-2021-45791

all versions

Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.p

8.8HIGH

CVE-2017-12584

<= 8.3.1

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated

8.8HIGH