How do I check whether I am affected by CVE-2026-107081?

Run SLiMS 9.8.0 (check the version in the admin footer or the SLiMS version constant in sysconfig) and these files exist: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php. Look in the web server logs for POSTs to those endpoints with tableName values containing SELECT or parentheses.

What is the fix for CVE-2026-107081?

No patched release yet (unknown). Until one ships: restrict /admin to trusted IPs or a VPN, remove staff accounts you do not need, and rotate admin passwords if untrusted staff had access. As a stopgap, block POSTs to the three endpoints whose tableName or tableFields contain characters other than [A-Za-z0-9_:,] (WAF rule). Upstream's suggested fix is a whitelist of table and column names. Watch slims/slims9_bulian#391 and the releases page.

Who is not affected by CVE-2026-107081?

Not affected if: auth-required.

Live › vulnerability › CVE-2026-107081

Go to dashboard

critical9.8PoC publicOther

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…

SLiMS Bulian 9.8.0 admin AJAX endpoints put the tableName and tableFields POST parameters straight into SQL identifiers (SELECT $fields FROM $table_name). Any logged-in staff account, whatever its role, can read any table, including admin password hashes. A public PoC exists. No fixed release exists as of 2026-10-23.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far6 of 6

First public: Oct 19, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Staff account reads entire database, including user credentials and patron data.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-107081

Go to dashboard

critical9.8PoC publicOther

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far6 of 6

First public: Oct 19, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Staff account reads entire database, including user credentials and patron data.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources