What’s Vulnerable › Vulnerabilities

CVE-2023-3744: Server-Side Request Forgery in SLiMS

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-02 · updated 2026-06-17
• Weakness: CWE-918

Description

Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in the imageURL parameter.

Affected products

• SLIMS Senayan Library Management System: 9.6.0

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims
• https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-slims

Get alerted when CVE-2023-3744 or the next vulnerability affects your stack