How do I check whether I am affected by CVE-2026-107082?

Check your version in the admin footer or system info; 9.8.0 is affected. In code, look at admin/modules/bibliography/index.php around lines 1352-1360 for "AND opac_hide =" . $opac_hide without an int cast. Check web logs for requests to the bibliography index.php with opac_hide or promoted values that are not 0 or 1 (EXTRACTVALUE, UNION, SELECT).

What is the fix for CVE-2026-107082?

No patched release yet; latest is 9.8.0. Workaround: cast the values with (int) or allow only 0/1 before concatenating (opac_hide and promoted), as in the reporter's recommendation. Also set the first escape_sql filter in admin/default/session.inc.php:35 to true. Limit staff accounts, restrict /admin by IP or VPN, and watch upstream issue #392 for a fix.

Who is not affected by CVE-2026-107082?

Not affected if: auth-required, no-staff-accounts, not-version-9.8.0.

Live › vulnerability › CVE-2026-107082

Go to dashboard

high8.8Package

Slims library system: staff SQL injection exposes database contents

SLiMS 9.8.0 admin bibliography page (admin/modules/bibliography/index.php) concatenates opac_hide and promoted GET parameters unquoted into SQL after escape_string(), which does nothing for quote-free payloads. Any logged-in staff account, whatever its role, can extract database contents (error-based/UNION). There is a public PoC. No fixed release exists yet.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far6 of 6

First public: Oct 19, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Staff attacker reads arbitrary database tables, including member and admin credentials.
CVSS said: 8.8. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-107082

Go to dashboard

high8.8Package

Slims library system: staff SQL injection exposes database contents

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far6 of 6

First public: Oct 19, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: 1 PoC repo on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, proof of concept public on GitHub.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Staff attacker reads arbitrary database tables, including member and admin credentials.
CVSS said: 8.8. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Slims library system: staff SQL injection exposes database contents

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Slims library system: staff SQL injection exposes database contents

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources