CVE-2026-107084: n/a
Description
Slims (Senayan Library Management Systems) version 9.8.0 contains a cross-site request forgery (CSRF) vulnerability in the loan history maintenance functionality. The vulnerability arises because the action=run GET parameter triggers privileged, destructive operations without requiring a CSRF token or POST confirmation. This flaw allows an attacker to cause data loss of loan history records via unauthorized requests.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107084 describes a CSRF vulnerability in Slims 9.8.0 where the admin/modules/circulation/loan_history_maintenance.php script accepts an action=run GET parameter that performs privileged destructive operations without CSRF protections such as tokens or POST method enforcement. This lack of validation enables attackers to induce unintended destructive actions on loan history data by tricking authenticated administrators into executing crafted requests.
Potential Impact
Successful exploitation results in loss of loan history records due to unauthorized execution of destructive operations. This compromises data integrity within the library management system but does not indicate direct code execution or broader system compromise based on the available information.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should restrict access to the affected functionality, implement additional CSRF protections if possible, and avoid performing administrative actions via GET requests. Monitoring for suspicious activity related to loan history maintenance is advisable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-10-07T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6ad654932cdf04f65678e045
Added to database: 10/19/2026, 17:34:11 UTC
Last enriched: 10/19/2026, 17:48:46 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.