SNMP
CVE-2026-27016
MEDIUM
GHSA-fqx6-693c-f55g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.
AnalysisAI
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious scripts through the unsanitized unit parameter in Custom OID configurations, which are then executed when other users view the affected pages. An attacker with login credentials could exploit this to steal session tokens, perform actions on behalf of other administrators, or compromise the monitoring infrastructure. The vulnerability has been patched in version 26.2.0.
Technical ContextAI
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the unit component of Librenms. LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 26.2.0.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Hardcoded/insecure credentials in IDC SFX Series SuperFlex Satellite Receiver. Multiple accounts with known credentials
html5_snmp 1.11 has multiple SQL injection vulnerabilities allowing attackers to manipulate SNMP monitoring database que
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap
html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scrip
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to injec
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP C
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when oth
Improper SNMP request parsing in Cisco Nexus 9000 Series switches running ACI mode allows authenticated remote attackers
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today