CVE-2026-107081
Published
20Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attend
from disclosure to weapon0 days
Published on NVDOct 19
1st PoCOct 14
exploitation probability
—
observed exploitation
nono source reports it
1 public exploit(s)
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
Affected products
n/a · n/apublic PoCs found — 1
githubgithub.com/Primandito/CVE-2026-107081★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.