Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-107082 EUVD-2026-104518GHSA-7xj3-7hjg-4hv6

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and…

Published Oct 19, 2026 · Updated Oct 20, 2026 · Assigned by mitre

Description

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Primandito/CVE-2026-107082 ★ 0 · Oct 17, 2026

    SQL Injection via opac_hide / promoted GET parameters in SLiMS 9.8.0 admin bibliography module. CVE-2026-107082.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References