CVE-2025-65233
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Risk Assessment
An attacker can steal user sessions, take over accounts, or perform unauthorized actions in the victim's context.
Recommendation
Update SLiMS to version 9.6.0 or later that includes the fix.
Other vulnerabilities in SLiMS
See all- CVE-2026-107083Critical
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.
- CVE-2026-107081Critical
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints in SLiMS Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.
- CVE-2026-107082High
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.
Original NVD description (English source)
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS