CVE-2026-107081: SQL Injection

Published Oct 19, 2026

Updated

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.

Affected Software

1 affected component

SENAYAN SENAYAN Library Management System (SLiMS) Bulian=9.8.0

Event History

Oct 19, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated staff user can exploit the vulnerable admin AJAX endpoints. The issue is not described as requiring administrator-level privileges beyond staff authentication.

What access does an attacker need?

The attacker needs valid staff credentials and the ability to send POST requests to the affected admin AJAX endpoints. Exploitation uses identifier injection in the tableName and tableFields parameters.

What could an attacker obtain?

A successful exploit allows extraction of arbitrary database contents through SQL injection.

CVE-2026-107081: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What could an attacker obtain?