Slims
Slims Senayan Library Management System: vulnerabilidades y CVE
Slims Senayan Library Management System tiene 19 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE19
Últimos 12 meses1
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-50805 | Alta (8.8) | 0.36% | — | 13 ene 2026 | Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting… |
| CVE-2025-25403 | Crítica (9.8) | 0.42% | — | 29 abr 2025 | Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php. |
| CVE-2025-26200 | Alta (7.2) | 0.54% | — | 24 feb 2025 | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
| CVE-2024-25288 | Media (4.9) | 0.55% | — | 21 feb 2024 | SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php. |
| CVE-2023-45996 | Alta (8.8) | 1.1% | — | 31 oct 2023 | SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the… |
| CVE-2023-3744 | Alta (8.8) | 0.56% | — | 2 oct 2023 | Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the… |
| CVE-2023-40970 | Alta (8.8) | 0.74% | — | 1 sept 2023 | Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php. |
| CVE-2023-40969 | Media (6.1) | 0.39% | — | 1 sept 2023 | Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php. |
| CVE-2023-29850 | Alta (7.5) | 0.75% | — | 14 abr 2023 | SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information. |
| CVE-2022-45019 | Alta (7.5) | 0.76% | — | 5 dic 2022 | SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter. |
| CVE-2022-43362 | Alta (7.2) | 0.75% | — | 1 nov 2022 | Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php. |
| CVE-2022-43361 | Media (4.8) | 0.41% | — | 1 nov 2022 | Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php. |
| CVE-2022-38292 | Crítica (9.8) | 0.93% | — | 12 sept 2022 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php. |
| CVE-2022-38291 | Media (6.1) | 0.50% | — | 12 sept 2022 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML… |
| CVE-2021-45794 | Alta (7.5) | 1.1% | — | 17 mar 2022 | Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained. |
| CVE-2021-45793 | Alta (7.5) | 4.5% | — | 17 mar 2022 | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. |
| CVE-2021-45792 | Media (4.8) | 0.49% | — | 17 mar 2022 | Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php. |
| CVE-2021-45791 | Alta (8.8) | 0.97% | — | 17 mar 2022 | Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin/modules/system/user_group.php, and /admin/modules/membership/index.php through… |
| CVE-2017-12584 | Alta (8.8) | 0.93% | — | 6 ago 2017 | There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.