Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
77 results · page 1 of 2
Oct 19, 2026Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.phCVE-2026-107084 · Other software · reported by MITREHigh 8.8
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the pCVE-2026-107083 · Other software · reported by MITRECritical 9.8
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parametCVE-2026-107082 · Other software · reported by MITREHigh 8.8
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-18666 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- Product
- Library Management System
- Fixed in
- 3.6.7
- What to do
- Update Library Management System to 3.6.7 or newer.
Jul 13, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-12582 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- Product
- Library Management System
- Fixed in
- 3.5.8
- What to do
- Update Library Management System to 3.5.8 or newer.
Jun 26, 2026A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an autheCVE-2026-50767 · Other software · Koha · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field (checkinmsg).
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgnas.gitbook.iolgnas.gitbook.io
Jun 26, 2026A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticatedCVE-2026-50766 · Other software · Koha · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgnas.gitbook.iolgnas.gitbook.io
Jun 26, 2026A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions CVE-2026-50765 · Other software · Koha · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgnas.gitbook.iolgnas.gitbook.io
Jun 26, 2026Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.CVE-2026-56034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
May 4, 2026Beets is the media library management system.CVE-2026-42052 · Other software · beetbox · reported by GitHubMedium 6
Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by <%- ... %>. Rendered output is then inserted with .html(...), allowing attacker-controlled markup to become active DOM. This issue has been patched in version 2.10.0.
- Product
- beets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Library Management System: SQL InjectionCVE-2025-12707 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Library Management System
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Library Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 26, 2026Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject maCVE-2020-36954 · Other software · Xeroneit · reported by VulnCheckMedium 5.1
Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject malicious scripts. Attackers can insert a payload in the Category Name field to execute arbitrary JavaScript code when the page is loaded.
- Product
- Xeroneit Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jan 13, 2026Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries.CVE-2022-50805 · Other software · SLIMS · reported by VulnCheckHigh 8.8
Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries. Attackers can exploit the vulnerability by submitting crafted payloads to manipulate database queries and potentially extract sensitive information.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comslims.web.id
Oct 20, 2025An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and CVE-2025-61488 · Other software · reported by MITREHigh 7.6
An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Library Management System: Unauthorized modification of dataCVE-2025-10303 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the plugin's settings and features.
- Product
- Library Management System
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Library Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 16, 2025An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCVE-2025-57119 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function
- Product
- Online Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24.CVE-2025-9755 · Other software · Khanakag-17 · reported by VulDBLow 2.1
A vulnerability has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24. This affects an unknown function of the file /index.php. The manipulation of the argument msg leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 21, 2025Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters.CVE-2010-20112 · Other software · Amlib · reported by VulnCheckCritical 9.3
Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments
- Product
- Amlibweb Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.checkpoint.comraw.githubusercontent.com
Jul 25, 2025A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05.CVE-2025-52360 · Other software · reported by MITREHigh 8.8
A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.CVE-2025-45820 · Other software · Slims · reported by MITREMedium 6.5
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.CVE-2025-45819 · Other software · Slims · reported by MITREMedium 6.5
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php.CVE-2025-45818 · Other software · Slims · reported by MITREMedium 6.5
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.CVE-2025-25403 · Other software · reported by MITRECritical 9.8
Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.CVE-2025-26200 · Other software · Slims · reported by MITREHigh 7.2
SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commebroccoli.blogspot.com
Jan 22, 2025A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/cCVE-2025-22980 · Other software · Slims · reported by MITREMedium 6.7
A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/circulation/loan.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commebroccoli.blogspot.com
Dec 12, 2024Library Management System – Manage e-Digital Books Library: SQL InjectionCVE-2024-12406 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Library Management System – Manage e-Digital Books Library
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Library Management System – Manage e-Digital Books Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024Library Management System – Manage e-Digital Books Library: SQL InjectionCVE-2024-8679 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owt_lib_handler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Library Management System – Manage e-Digital Books Library
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Library Management System – Manage e-Digital Books Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024A vulnerability was found in kitsada8621 Digital Library Management System 1.0.CVE-2024-8297 · Other software · kitsada8621 · reported by VulDBMedium 6.9
A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwt_refresh_token_middleware.go. The manipulation of the argument Authorization leads to improper output neutralization for logs. It is possible to launch the attack remotely. The name of the patch is 81b3336b4c9240f0bf50c13cb8375cf860d945f1. It is recommended to apply a patch to fix this issue.
- Product
- Digital Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2024Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php.CVE-2024-40394 · Other software · sourcecodester · reported by MITRECritical 9.8
Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php.
- Product
- simple_library_management_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.CVE-2024-25288 · Other software · slims_project · reported by MITREMedium 4.9
SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
- Product
- slims
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allowCVE-2024-24337 · Other software · koha-community · reported by MITREHigh 8
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
- Product
- koha_library_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnitipoom-jar.github.ionitipoom-jaroonchaipipat.github.io
Dec 1, 2023SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.CVE-2023-48893 · Other software · Slims · reported by MITREHigh 8.8
SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.CVE-2023-48813 · Other software · Slims · reported by MITREHigh 8.8
Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
- Product
- Senayan Library Management System Bulian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execCVE-2023-45996 · Other software · Slims · reported by MITREHigh 8.8
SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the reborrowLimit parameter in the member_type.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.CVE-2023-40970 · Other software · Slims · reported by MITREHigh 8.8
Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.CVE-2023-40969 · Other software · Slims · reported by MITREMedium 6.1
Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images.CVE-2023-29850 · Other software · Slims · reported by MITREHigh 7.5
SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.CVE-2022-45019 · Other software · Slims · reported by MITREHigh 7.5
SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.CVE-2022-43362 · Other software · Slims · reported by MITREHigh 7.2
Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.CVE-2022-43361 · Other software · Slims · reported by MITREMedium 4.8
Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php andCVE-2022-38292 · Other software · Slims · reported by MITRECritical 9.8
SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function.CVE-2022-38291 · Other software · Slims · reported by MITREMedium 6.1
SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2022In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.CVE-2022-37794 · Other software · Library Management System Project · reported by MITRECritical 9.8
In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php.CVE-2022-36735 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php.CVE-2022-36734 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php.CVE-2022-36733 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php.CVE-2022-36732 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.CVE-2022-36731 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php.CVE-2022-36730 · Other software · Library Management System Project · reported by MITRECritical 9.8
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.CVE-2022-36657 · Other software · Library Management System Project · reported by MITREMedium 4.8
Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php.
- Product
- Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.