How do I check whether I am affected by CVE-2026-107083?

Check whether the installed version is slims9_bulian 9.8.0 (unknown exact check command). Look for admin/modules/reporting/customs/dl_detail.php in the install and check whether fileID is passed unescaped into SQL.

What is the fix for CVE-2026-107083?

Restrict access to the admin area until a fix is confirmed.

Who is not affected by CVE-2026-107083?

Not affected if: default-config.

Live › vulnerability › CVE-2026-107083

Go to dashboard

critical9.8Package

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in…

SLiMS (SENAYAN Library Management System) Bulian 9.8.0 has a SQL injection in the admin reporting download page admin/modules/reporting/customs/dl_detail.php through the fileID parameter. An attacker can read or change the library database through crafted input to that parameter.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or alters library database contents through the admin reporting endpoint.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-107083

Go to dashboard

critical9.8Package

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 19, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or alters library database contents through the admin reporting endpoint.
CVSS said: 9.8. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

No product ranges from the sources yet.

Know the next one before it finds you.

Add to Slack

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources