CVE-2026-111654

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-111654

Versions of FastBee through 2.1.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the /iot/group By-ID endpoints. The root cause is that GroupController queries fail to perform necessary owner checks , allowing authenticated low-privilege users—including self-reg...

EUVD-2026-103076

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

PT-2026-116053

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to rea...

CVE-2026-40832

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

EUVD-2026-32161

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

CVE-2026-27668

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary SAM-P All versions V5.8. User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access t...

CVE-2026-27668

CVE-2026-27668 affects RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) with all versions below v5.8. The issue allows an authenticated User Administrator to escalate their own privileges by administering groups they belong to, enabling access to any device group at any access level. Docu...

CVE-2026-27668

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary SAM-P All versions V5.8. User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access t...

CVE-2026-27668

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary SAM-P All versions V5.8. User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access t...

CVE-2026-27668

A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary SAM-P All versions V5.8. User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrator to escalate their own privileges and grant themselves access t...

CVE-2026-26991

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting XSS attacks. When a user adds a device group, an HTTP POST request is...

CVE-2026-26991

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting XSS attacks. When a user adds a device group, an HTTP POST request is...

CVE-2026-26991

LibreNMS (versions 26.1.1 and earlier) is vulnerable to Stored Cross‑Site Scripting via the /device-groups name parameter when an admin user creates a device group. The unsanitized name can be stored and later rendered in the UI (e.g., Delete button context), enabling injected JavaScript. The iss...

CVE-2026-26991 LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting XSS attacks. When a user adds a device group, an HTTP POST request is...

CVE-2026-26991 LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing attackers with admin privileges to perform Stored Cross-Site Scripting XSS attacks. When a user adds a device group, an HTTP POST request is...

GHSA-5PQF-54QP-32WX LibreNMS /device-groups name Stored Cross-Site Scripting

Summary /device-groups name Stored Cross-Site Scripting - HTTP POST - Request-URIs: "/device-groups" - Vulnerable parameters: "name" - Attacker must be authenticated with "admin" privileges. - When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The...

LibreNMS /device-groups name Stored Cross-Site Scripting

Summary /device-groups name Stored Cross-Site Scripting - HTTP POST - Request-URIs: "/device-groups" - Vulnerable parameters: "name" - Attacker must be authenticated with "admin" privileges. - When a user adds a device group, an HTTP POST request is sent to the Request-URI "/device-groups". The...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the name parameter in the HTTP POST request to /device-groups. An attacker with admin...

PT-2026-20788

Name of the Vulnerable Software and Affected Versions LibreNMS versions 26.1.1 and below Description LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, contains a Stored Cross-Site Scripting XSS issue. The device group name is not sanitized, allowing attackers with admin...