SLiMS 9 Bulian CVE-2026-107084

Requires a victim who is an authenticated SLiMS administrator with an active session to be tricked into loading attacker-controlled content that issues admin/modules/circulation/loan_history_maintenance.php?action=run. The specific enabling weakness is that this administrative, destructive endpoint accepts the action via a GET request with no anti-CSRF token and no POST confirmation step, so any cross-site request carrying the admin's session cookie succeeds. Limiting factors: exploitation is impossible without an authenticated admin performing the user interaction (UI:R), so it cannot be fully automated or run unattended; it also depends on the admin session being active in the same browser when the forged request fires.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) is the main severity signal, but it overstates real-world risk for a CSRF flaw. Attack vector is network and complexity low, and PR:N reflects that the attacker themselves needs no credentials, but UI:R is load-bearing here: exploitation requires an already-authenticated SLiMS administrator to be lured into triggering the malicious action=run GET request. The supplied C:H is questionable for classic CSRF because the attacker cannot read the cross-origin response - the realistic impact is destructive (deletion/loss of loan history records), i.e. integrity/availability of that data, not confidentiality disclosure; verify the confidentiality rating with the reporter. EPSS is low at 0.20% (9th percentile) and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation. A public PoC reference exists (github.com/Primandito/CVE-2026-107084) but is not verified as working exploit code. No SSVC automatable/technical-impact decision values were provided; the only decision signal is the vuln.today 'this_week' priority. Net: a genuine, straightforwardly-triggered CSRF worth patching on a normal (this-week) cadence rather than an emergency - the high CVSS is tempered by the required admin interaction, the low EPSS, the absence of KEV, and the niche deployment footprint of the product.

An attacker hosts a web page (or sends an email/link) containing an auto-loading image or redirect pointing at admin/modules/circulation/loan_history_maintenance.php?action=run on a target SLiMS install. When a logged-in SLiMS administrator visits that page, their browser silently replays the request with their session cookie, executing the privileged destructive operation and wiping loan history records. A public PoC reference exists but is not verified as working exploit code; exploitation is gated on tricking an authenticated admin into visiting the attacker's content.