CVE-2026-107084

Not scored yetLast modified Oct 19, 2026

Description

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data loss of loan history records.

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Oct 19, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-107097.8A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxCVE-2026-10714.4The Carta Online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, CVE-2026-107107.8A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtCVE-2026-1071029.3This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controlsCVE-2026-1071039.3This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. ACVE-2026-1071049.3This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenCVE-2026-107118.8Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows ACVE-2026-107126.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 CVE-2026-1071205.3The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verificatCVE-2026-1071216.5A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak CVE-2026-1071256.3A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the aCVE-2026-1071268.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it an
CVE-2026-107084: Unscored | Vulnix