Live › vulnerability › CVE-2026-107084
Go to dashboardSlims 9 Bulian 9.8.0 has a GET parameter action=run on admin/modules/circulation/loan_history_maintenance.php that performs destructive loan history operations without a CSRF token or POST confirmation. An attacker can make a logged-in administrator's browser trigger the deletion, causing loss of loan history records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Libraries and organizations running Slims 9 Bulian 9.8.0 with an administrator who uses the web admin panel in the same browser they use for other sites. Installations where the admin module is only reachable from a restricted internal network carry less exposure. Sites not running this version can skip it.
No product ranges from the sources yet.
9.8.0 in the application's version file or admin footeradmin/modules/circulation/loan_history_maintenance.php exists and accepts action=run via GETUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.
This page as .md · .json · in your agent: get_signal("CVE-2026-107084")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.