CVE-2026-107084
Received Received - Intake

CSRF in SLiMS 9 Bulian Loan History Maintenance

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: MITRE

Description
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-107084
EUVD
EUVD-2026-104552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107084 is a Cross-Site Request Forgery (CSRF) vulnerability in SLiMS version 9.8.0 that allows unauthorized data loss. The issue exists in the loan history maintenance module where the action=run GET parameter triggers destructive operations like truncating the loan_history table via task=empty or task=rebuild_all.

Detection Guidance

Check if the vulnerable URL path exists on your SLiMS 9.8.0 system by accessing admin/modules/circulation/loan_history_maintenance.php?action=run&task=empty. If the loan_history table is truncated after accessing this URL, the system is vulnerable. Also inspect network traffic for GET requests to this endpoint with action=run or task parameters.

Impact Analysis

An authenticated admin can be tricked into clicking a malicious link, leading to permanent deletion of all loan history records. The vulnerability allows attackers to perform privileged operations without CSRF token validation or POST confirmation.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by enabling unauthorized deletion of sensitive loan history data, potentially violating data integrity and retention requirements.

Mitigation Strategies

Immediately update SLiMS to a patched version that enforces POST requests with CSRF token validation for destructive operations. As a temporary workaround, restrict access to the admin/modules/circulation/loan_history_maintenance.php file via server configuration or firewall rules until an official patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart