UNKNOWN NVD

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.

References

https://github.com/Primandito/CVE-2026-107081
https://github.com/slims/slims9_bulian/issues/391

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This unknown severity vulnerability was published on 2026-10-19 via NVD.

vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.