SLiMS Bulian CVE-2026-107081

Requires a valid authenticated SLiMS staff account (the description states 'any authenticated staff user'), so this is NOT exploitable pre-authentication despite the input CVSS PR:N. The attacker must reach the admin AJAX endpoints admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, or admin/AJAX_vocabolary_control.php and supply malicious SQL identifiers in the tableName or tableFields POST parameters. Limiting factors: staff-level authentication is mandatory, the affected build is specifically SLiMS Bulian 9.8.0, and the admin AJAX interface must be network-reachable; no victim user interaction is needed.

Signals conflict and must be reconciled before prioritizing. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this critical and unauthenticated, but the description explicitly states exploitation 'allows any authenticated staff user' - so PR:N is inconsistent; a valid staff account is required and the realistic base score is closer to ~6.5 (Medium). EPSS is low at 0.33% (25th percentile), indicating no statistical signal of widespread exploitation, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. However, a dedicated public exploit reference exists (github.com/Primandito/CVE-2026-107081), so publicly available exploit code likely exists, lowering the skill barrier. Net assessment: this is a genuine SQL injection flaw worth patching, but it is a post-authentication issue in a niche library product, not an internet-wide unauthenticated emergency - the 9.8 'critical' label overstates real-world urgency. Priority: moderate; patch on a normal cycle and restrict staff account provisioning. CONFLICT TO VERIFY: CVSS vector says PR:N (unauthenticated) but description says authenticated staff user - verify the privilege requirement with the vendor advisory.

An attacker who holds or phishes a low-level SLiMS staff account sends a crafted POST request to an admin AJAX endpoint (e.g. admin/AJAX_lookup_handler.php) injecting SQL through the tableName or tableFields parameter to dump arbitrary tables such as member records or session data. Because the injection is network-reachable with low complexity and public exploit code appears to exist (Primandito GitHub repo), reproduction is straightforward once staff access is obtained.