Librenms
Monthly
Authentication bypass in LibreNMS before 26.9.0 allows unauthenticated remote attackers to gain administrative access when the system is configured for LDAP or Active Directory authorization and the REMOTE_USER server variable is not forwarded by an upstream proxy. The flaw arises because usernames are inserted unescaped into LDAP search filters, and authentication only verifies that a matching entry exists; an attacker can supply a wildcard username via the HTTP Basic Authorization header (PHP_AUTH_USER) to match all users and groups, resulting in admin privileges. Exploitation requires the vulnerable authorization mode to be active and REMOTE_USER to be absent; installations using other auth backends or a correctly configured front-end proxy are not exploitable via this path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
Argument injection in LibreNMS's graph_title parameter allows authenticated low-privilege users to break out of double-quote escaping and inject arbitrary rrdtool arguments, effectively bypassing per-device authorization controls. Affected versions prior to 26.8.0 permit attackers to inject DEF and LINE directives to read RRD files from devices they are not authorized to access, or use newline injection to execute arbitrary rrdtool commands. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid low-privilege account, lowering the exploitation bar significantly.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
OS command injection in LibreNMS's libvirt discovery module (VminfoLibvirt.php) enables any authenticated administrator to execute arbitrary OS commands on the discovery worker host by setting a crafted device hostname. Affected deployments span LibreNMS 23.10.0 through 26.3.x wherever the enable_libvirt option is explicitly set to true; the vendor-released fix is version 26.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is straightforward for any actor holding admin credentials.
Stored XSS across multiple legacy PHP templates in LibreNMS allows an attacker who controls a monitored network device to inject arbitrary JavaScript via SNMP-polled fields (ifAlias, mempool_descr, storage_descr, sensor_descr) or syslog program fields, with payload execution triggered when any authenticated LibreNMS user browses alerts, health dashboards, or syslog views. The vulnerability spans at least five distinct template locations and stems from inconsistent output encoding - adjacent fields in the same code paths are correctly escaped, but affected fields are not. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high confidentiality impact from potential session token theft makes patching a priority for any network operations team.
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. No public exploit has been identified and this vulnerability is absent from CISA KEV; vendor-released patch 26.5.0 is available.
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execute arbitrary OS commands on the underlying host server. Covering all tracked versions per CPE cpe:2.3:a:librenms:librenms:*, this CWE-78 flaw was disclosed by PRJBLK alongside a publicly available proof-of-concept exploit targeting version 26.5.0. No CISA KEV listing was identified at time of analysis, but the public PoC materially lowers the exploitation bar for any attacker who already holds admin credentials.
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administrators to execute arbitrary commands on the underlying web server by manipulating Binary Locations configuration settings combined with the Netcommand feature. This authenticated attack requires administrative privileges but has publicly available exploit code, enabling straightforward weaponization. CVSS 8.5 severity reflects high confidentiality and integrity impact with network-based attack vector and low complexity.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database information through time-based blind SQL injection in the address-search function. An attacker with valid credentials can manipulate the subnet prefix parameter to bypass query logic and infer data through conditional timing responses. Public exploit code exists for this vulnerability; upgrade to version 26.2.0 or later to remediate.
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in LibreNMS before 26.9.0 allows any authenticated account holding the global-read (read-only) role to permanently purge port records it has no delete rights over. By issuing a DELETE request to /ports/purge - optionally with purge=all - a low-privilege user can irreversibly erase every soft-deleted port across all devices visible to that account. The flaw is an authenticated privilege-escalation-style access-control gap (CVSS 3.1 5.3, PR:L) with integrity-only impact confined to already soft-deleted port entries; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor-released patch is LibreNMS 26.9.0.
Stored cross-site scripting in LibreNMS before 26.9.0 allows unauthenticated remote attackers who control the Oxidized API response or a monitored device's SNMP sysName to inject script that executes in the browsers of authenticated users viewing the Tools > Oxidized page. The flaw is rated medium severity (CVSS 5.3) and only affects the victim's browser session, not the LibreNMS host; exploitation requires the Oxidized integration to be enabled and limits exposure to deployments that actually use it. No public exploit code has been identified at time of analysis.
Path traversal in LibreNMS's nfsen_channel_common.inc.php allows an authenticated user who already has authorized access to at least one NFSen-enabled device to read RRD traffic and NetFlow graph data belonging to devices outside their permitted scope by injecting ../ sequences into the channel parameter supplied to graph.php. The flaw affects LibreNMS releases prior to 26.9.0 and is rated moderate (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), because it requires a valid low-privileged account plus an NFSen-enabled deployment and yields only read access with no integrity or availability impact. No public exploit code identified at time of analysis, and the issue is not listed under confirmed actively exploited (CISA KEV); single-tenant installations where the authenticated user is already entitled to every device gain nothing from the technique.
Stored cross-site scripting (XSS) in LibreNMS before 26.9.0 allows an attacker who controls the SNMP agent of a monitored device to inject JavaScript via wireless sensor description fields, which executes in the browser of an authenticated user viewing that device's Wireless tab and can lead to session hijacking. The CVSS 4.0 base score is 5.3, and exploitation requires user interaction (the victim must open the affected tab) plus the unusual precondition of controlling monitored-device SNMP data rather than LibreNMS credentials. No public exploit has been identified at time of analysis, and the independent assessment rates real-world urgency as materially lower than the raw score suggests because impact is confined to the victim's authenticated session.
An authorization bypass in LibreNMS through 26.9.1.1 lets a restricted user who has been granted access on at least one smokeping probe device view smokeping latency graphs for devices they are not authorized to see, including enumeration of device names. The flaw is in the smokeping graph authorization include, which validates the src probe device rather than the rendered target device, so requesting smokeping_in or smokeping_out with arbitrary device IDs succeeds. Exploitation requires an authenticated restricted account with probe access and a deployment using smokeping graphing; the impact is limited to read-only information disclosure with no integrity or availability effect, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.
Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.
Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.
Cross-site Scripting (XSS) in LibreNMS versions before 26.3.0 allows authenticated administrators to inject malicious scripts on the showconfig page, enabling attacks against other authorized users. The vulnerability requires high administrative privileges and user interaction (clicking a malicious link) to execute, resulting in integrity impact to other users' sessions. Publicly available exploit code exists, though CISA KEV status is not confirmed.
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through unsanitized port group names, which execute when other users view the affected port group. Public exploit code exists for this vulnerability. The issue is resolved in version 26.2.0.
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through unsanitized device group names, which execute when other users view the group management interface. Public exploit code exists for this vulnerability, affecting LibreNMS deployments across multiple supported platforms. The vulnerability has been patched in version 26.2.0.
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious scripts through the unsanitized unit parameter in Custom OID configurations, which are then executed when other users view the affected pages. An attacker with login credentials could exploit this to steal session tokens, perform actions on behalf of other administrators, or compromise the monitoring infrastructure. The vulnerability has been patched in version 26.2.0.
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when other users view the Alert Rules page, affecting versions 25.12.0 and below. Public exploit code exists for this vulnerability, though exploitation requires high-level administrative privileges and user interaction. The vulnerability has been patched in version 26.2.0.
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to inject malicious scripts via the email field, potentially compromising user sessions and enabling credential theft or malware distribution. Public exploit code exists for this vulnerability, and affected organizations should upgrade to version 26.2.0 or later immediately.
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. [CVSS 7.1 HIGH]
Stored cross-site scripting in LibreNMS versions prior to 25.12.0 allows an attacker holding a privileged API token to create or update an alert rule whose name contains HTML markup, which is then executed when another authenticated user opens the Alerts > Alert Rules page. Publicly available exploit code exists, and EPSS is 3.88% (90th percentile), but this is an authentication-gated, moderate-severity issue rather than a top-tier emergency; no CISA KEV confirmation was provided.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in LibreNMS alert rule names allows an authenticated administrator with alert-rule management privileges to inject HTML that executes in another administrator's browser when the Alerts > Alert Rules page is viewed, affecting versions through 25.8.0 and fixed in 25.10.0. Publicly available exploit code exists, but EPSS is low at 0.28% (19th percentile) and no CISA KEV confirmation is provided.
Stored cross-site scripting in LibreNMS 25.8.0 and earlier lets an authenticated administrator persist JavaScript through the Transport name field, which executes in an administrator's browser when the Alert Rules page is viewed. The issue is fixed in 25.10.0; publicly available exploit code exists, and EPSS is elevated at 12.72% (96th percentile), but exploitation and impact are confined to administrator accounts because both creating transports and viewing Alert Rules require admin privileges. An attacker with a rogue or compromised admin account could use the stored payload to perform actions in the admin's LibreNMS session, though the vector's PR:H and UI:R requirements substantially limit exposure.
Reflected cross-site scripting in LibreNMS before 25.7.0 lets unauthenticated attackers inject script through the project_issues value when a victim visits a crafted error page and clicks the generated 'report this' link. The flaw comes from using htmlentities() to build an href, which does not block javascript: URLs, and exploitation requires user interaction while limiting impact to the victim's browser session. Publicly available exploit code exists; EPSS is low at 0.25%, and no CISA KEV active-exploitation confirmation was provided.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is PHP/MySQL/SNMP based network monitoring software. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Authentication bypass in LibreNMS before 26.9.0 allows unauthenticated remote attackers to gain administrative access when the system is configured for LDAP or Active Directory authorization and the REMOTE_USER server variable is not forwarded by an upstream proxy. The flaw arises because usernames are inserted unescaped into LDAP search filters, and authentication only verifies that a matching entry exists; an attacker can supply a wildcard username via the HTTP Basic Authorization header (PHP_AUTH_USER) to match all users and groups, resulting in admin privileges. Exploitation requires the vulnerable authorization mode to be active and REMOTE_USER to be absent; installations using other auth backends or a correctly configured front-end proxy are not exploitable via this path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
Argument injection in LibreNMS's graph_title parameter allows authenticated low-privilege users to break out of double-quote escaping and inject arbitrary rrdtool arguments, effectively bypassing per-device authorization controls. Affected versions prior to 26.8.0 permit attackers to inject DEF and LINE directives to read RRD files from devices they are not authorized to access, or use newline injection to execute arbitrary rrdtool commands. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid low-privilege account, lowering the exploitation bar significantly.
Authentication bypass in the LibreNMS REST API (all versions before 26.8.0) lets unauthenticated remote attackers reach protected endpoints by submitting a small integer (0-9) in place of a string API token, abusing MySQL loose type coercion so the integer matches a stored token hash. Successful bypass exposes device credentials and administrative functionality, and can be chained to remote code execution through alert templates. Reported by VulnCheck; no public exploit is identified at time of analysis, though the type-confusion technique is fully described in the advisory.
OS command injection in LibreNMS's libvirt discovery module (VminfoLibvirt.php) enables any authenticated administrator to execute arbitrary OS commands on the discovery worker host by setting a crafted device hostname. Affected deployments span LibreNMS 23.10.0 through 26.3.x wherever the enable_libvirt option is explicitly set to true; the vendor-released fix is version 26.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is straightforward for any actor holding admin credentials.
Stored XSS across multiple legacy PHP templates in LibreNMS allows an attacker who controls a monitored network device to inject arbitrary JavaScript via SNMP-polled fields (ifAlias, mempool_descr, storage_descr, sensor_descr) or syslog program fields, with payload execution triggered when any authenticated LibreNMS user browses alerts, health dashboards, or syslog views. The vulnerability spans at least five distinct template locations and stems from inconsistent output encoding - adjacent fields in the same code paths are correctly escaped, but affected fields are not. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high confidentiality impact from potential session token theft makes patching a priority for any network operations team.
Remote code execution in LibreNMS versions before 26.5.0 stems from the AboutController passing the snmpget configuration value directly to shell_exec() with a validation mechanism rendered ineffective by a PHP assignment operator bug. An authenticated administrator can update the snmpget setting to reference any executable already present on the server filesystem, then trigger code execution by visiting the /about endpoint, yielding full host compromise under web server privileges. No public exploit has been identified and this vulnerability is absent from CISA KEV; vendor-released patch 26.5.0 is available.
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.
Command injection in LibreNMS's Virtualization Discovery module enables authenticated administrator-level users to execute arbitrary OS commands on the underlying host server. Covering all tracked versions per CPE cpe:2.3:a:librenms:librenms:*, this CWE-78 flaw was disclosed by PRJBLK alongside a publicly available proof-of-concept exploit targeting version 26.5.0. No CISA KEV listing was identified at time of analysis, but the public PoC materially lowers the exploitation bar for any attacker who already holds admin credentials.
Remote code execution in LibreNMS network monitoring platform (versions prior to 26.3.0) allows authenticated administrators to execute arbitrary commands on the underlying web server by manipulating Binary Locations configuration settings combined with the Netcommand feature. This authenticated attack requires administrative privileges but has publicly available exploit code, enabling straightforward weaponization. CVSS 8.5 severity reflects high confidentiality and integrity impact with network-based attack vector and low complexity.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database information through time-based blind SQL injection in the address-search function. An attacker with valid credentials can manipulate the subnet prefix parameter to bypass query logic and infer data through conditional timing responses. Public exploit code exists for this vulnerability; upgrade to version 26.2.0 or later to remediate.
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
An issue was discovered in LibreNMS through 1.47. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in LibreNMS before 26.9.0 allows any authenticated account holding the global-read (read-only) role to permanently purge port records it has no delete rights over. By issuing a DELETE request to /ports/purge - optionally with purge=all - a low-privilege user can irreversibly erase every soft-deleted port across all devices visible to that account. The flaw is an authenticated privilege-escalation-style access-control gap (CVSS 3.1 5.3, PR:L) with integrity-only impact confined to already soft-deleted port entries; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor-released patch is LibreNMS 26.9.0.
Stored cross-site scripting in LibreNMS before 26.9.0 allows unauthenticated remote attackers who control the Oxidized API response or a monitored device's SNMP sysName to inject script that executes in the browsers of authenticated users viewing the Tools > Oxidized page. The flaw is rated medium severity (CVSS 5.3) and only affects the victim's browser session, not the LibreNMS host; exploitation requires the Oxidized integration to be enabled and limits exposure to deployments that actually use it. No public exploit code has been identified at time of analysis.
Path traversal in LibreNMS's nfsen_channel_common.inc.php allows an authenticated user who already has authorized access to at least one NFSen-enabled device to read RRD traffic and NetFlow graph data belonging to devices outside their permitted scope by injecting ../ sequences into the channel parameter supplied to graph.php. The flaw affects LibreNMS releases prior to 26.9.0 and is rated moderate (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), because it requires a valid low-privileged account plus an NFSen-enabled deployment and yields only read access with no integrity or availability impact. No public exploit code identified at time of analysis, and the issue is not listed under confirmed actively exploited (CISA KEV); single-tenant installations where the authenticated user is already entitled to every device gain nothing from the technique.
Stored cross-site scripting (XSS) in LibreNMS before 26.9.0 allows an attacker who controls the SNMP agent of a monitored device to inject JavaScript via wireless sensor description fields, which executes in the browser of an authenticated user viewing that device's Wireless tab and can lead to session hijacking. The CVSS 4.0 base score is 5.3, and exploitation requires user interaction (the victim must open the affected tab) plus the unusual precondition of controlling monitored-device SNMP data rather than LibreNMS credentials. No public exploit has been identified at time of analysis, and the independent assessment rates real-world urgency as materially lower than the raw score suggests because impact is confined to the victim's authenticated session.
An authorization bypass in LibreNMS through 26.9.1.1 lets a restricted user who has been granted access on at least one smokeping probe device view smokeping latency graphs for devices they are not authorized to see, including enumeration of device names. The flaw is in the smokeping graph authorization include, which validates the src probe device rather than the rendered target device, so requesting smokeping_in or smokeping_out with arbitrary device IDs succeeds. Exploitation requires an authenticated restricted account with probe access and a deployment using smokeping graphing; the impact is limited to read-only information disclosure with no integrity or availability effect, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.
Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.
Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.
Cross-site Scripting (XSS) in LibreNMS versions before 26.3.0 allows authenticated administrators to inject malicious scripts on the showconfig page, enabling attacks against other authorized users. The vulnerability requires high administrative privileges and user interaction (clicking a malicious link) to execute, resulting in integrity impact to other users' sessions. Publicly available exploit code exists, though CISA KEV status is not confirmed.
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through unsanitized port group names, which execute when other users view the affected port group. Public exploit code exists for this vulnerability. The issue is resolved in version 26.2.0.
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through unsanitized device group names, which execute when other users view the group management interface. Public exploit code exists for this vulnerability, affecting LibreNMS deployments across multiple supported platforms. The vulnerability has been patched in version 26.2.0.
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious scripts through the unsanitized unit parameter in Custom OID configurations, which are then executed when other users view the affected pages. An attacker with login credentials could exploit this to steal session tokens, perform actions on behalf of other administrators, or compromise the monitoring infrastructure. The vulnerability has been patched in version 26.2.0.
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when other users view the Alert Rules page, affecting versions 25.12.0 and below. Public exploit code exists for this vulnerability, though exploitation requires high-level administrative privileges and user interaction. The vulnerability has been patched in version 26.2.0.
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to inject malicious scripts via the email field, potentially compromising user sessions and enabling credential theft or malware distribution. Public exploit code exists for this vulnerability, and affected organizations should upgrade to version 26.2.0 or later immediately.
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. [CVSS 7.1 HIGH]
Stored cross-site scripting in LibreNMS versions prior to 25.12.0 allows an attacker holding a privileged API token to create or update an alert rule whose name contains HTML markup, which is then executed when another authenticated user opens the Alerts > Alert Rules page. Publicly available exploit code exists, and EPSS is 3.88% (90th percentile), but this is an authentication-gated, moderate-severity issue rather than a top-tier emergency; no CISA KEV confirmation was provided.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in LibreNMS alert rule names allows an authenticated administrator with alert-rule management privileges to inject HTML that executes in another administrator's browser when the Alerts > Alert Rules page is viewed, affecting versions through 25.8.0 and fixed in 25.10.0. Publicly available exploit code exists, but EPSS is low at 0.28% (19th percentile) and no CISA KEV confirmation is provided.
Stored cross-site scripting in LibreNMS 25.8.0 and earlier lets an authenticated administrator persist JavaScript through the Transport name field, which executes in an administrator's browser when the Alert Rules page is viewed. The issue is fixed in 25.10.0; publicly available exploit code exists, and EPSS is elevated at 12.72% (96th percentile), but exploitation and impact are confined to administrator accounts because both creating transports and viewing Alert Rules require admin privileges. An attacker with a rogue or compromised admin account could use the stored payload to perform actions in the admin's LibreNMS session, though the vector's PR:H and UI:R requirements substantially limit exposure.
Reflected cross-site scripting in LibreNMS before 25.7.0 lets unauthenticated attackers inject script through the project_issues value when a victim visits a crafted error page and clicks the generated 'report this' link. The flaw comes from using htmlentities() to build an href, which does not block javascript: URLs, and exploitation requires user interaction while limiting impact to the victim's browser session. Publicly available exploit code exists; EPSS is low at 0.25%, and no CISA KEV active-exploitation confirmation was provided.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is PHP/MySQL/SNMP based network monitoring software. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
librenms is a community-based GPL-licensed network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Code Injection in GitHub repository librenms/librenms prior to 23.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.