primandito/cve-2026-107081

This repository is a security write-up documenting SQL identifier injection in three SLiMS admin AJAX endpoints, rather than the SLiMS application itself. The documented workflow is an authenticated staff member submitting endpoint parameters that are interpolated into SQL, allowing database information to be disclosed. The README also identifies an admin-wide sanitizer configuration as a contributing factor. Only documented relationships are shown; no application source excerpts were provided, so implementation details beyond the write-up are not represented.