CVE-2023-48294

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48294

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48294: Exposure of Sensitive Information to an Unauthorized Actor

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

SUSE CVE-2007-6035

SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the localgraphid parameter...

SUSE CVE-2009-4032

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 graph.php, 2 include/topgraphheader.php, 3 lib/htmlform.php, and 4 lib/timespansettings.php, as demonstrated by the a graphend or b graphstart...

SUSE CVE-2010-2092

SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the...

Sql injection

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-12463

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-10671

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-10665

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

CVE-2019-12463: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-10671: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-10665: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

PT-2019-11978

Name of the Vulnerable Software and Affected Versions LibreNMS versions 1.47 and earlier Description The issue arises from insufficient validation or encoding of user-supplied input in the scripts handling graphing options, specifically in html/includes/graphs/common.inc.php and...

PT-2019-11984

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description The issue allows SQL injection due to insufficient parameterization of user-supplied input within database queries. An authenticated attacker can manipulate these database queries to extract or modif...

PT-2019-12808

Name of the Vulnerable Software and Affected Versions LibreNMS version 1.50.1 Description The issue arises from insufficient validation or encoding of user-supplied input in scripts handling graphing options. Specifically, the includes/html/graphs/common.inc.php and...

Deserialization of untrusted data

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...