Threats affecting pkg:github/slims/slims9_bulian

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

CVE-2025-65233 is a reflected cross-site scripting (XSS) vulnerability in SLiMS (slims9_bulian) versions before 9.6.0. It arises from improper handling of the PHP_SELF server variable in the index.php/sysconfig.inc.php file, allowing attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers. The vulnerability requires no privileges but does require user interaction to trigger. It impacts confidentiality and integrity by enabling theft of session tokens or manipulation of displayed content. The CVSS score is 6.

An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter

SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.