CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

CVE-2026-30480

CVE-2026-30480: LibreNMS Local File Inclusion LFI via Path Traversal Overview A Local File Inclusion LFI vulnerability exists in the NFSen module of LibreNMS. An authenticated attacker can exploit path traversal sequences to include arbitrary PHP files from the server filesystem. Field| Value...

CVE-2026-26988-LibreNMS-SQLi

CVE-2026-26988 – LibreNMS Unauthenticated SQL Injection PoC Unauthenticated SQL Injection in LibreNMS ajaxtable.php via IPv6 address search parameter. Affected versions : LibreNMS ≤ 25.12.0 Fixed in : LibreNMS ≥ 26.1 commit 15429580baba03ed1dd377bada1bde4b7a1175a1 CVSS v4.0 : 9.3 Critical...

cs4239-cve-2020-15873

CVE-2020-15873 Proof of Concept of CVE-2020-15873 - Blind SQL Injection in Librenms librenms librenms Development Debugging LibreNMS Docker Instance 1. Obtain a shell to the container: $ sudo docker exec -it librenmsvuln /bin/bash 2. To read the logs generated by LibreNMS: $ tail -f...

LibreNMS device wireless.inc.php Privilege Escalation

The vulnerability in the device/wireless.inc.php script of the LibreNMS network monitoring system relates to the lack of security measures for the website structure. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information and increase their...

LibreNMS nfsen_channel_common.inc.php Privilege Escalation

The vulnerability of the nfsenchannelcommon.inc.php script of the LibreNMS network monitoring system is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information and...

LibreNMS LDAP Authorization Full Control

The vulnerability of the “ldap-authorization” and “ad-authorization” configurations in the LibreNMS network monitoring system is related to the failure to take measures to neutralize special elements in LDAP requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, ...

CVE-2026-109357

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109352

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109355

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...

CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109354

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

EUVD-2026-97659

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

EUVD-2026-97658

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109356

LibreNMS versions before 26.9.0 are susceptible to a missing authorization vulnerability in the PortsController::purge function. This flaw allows users with global-read (read-only) accounts to bypass necessary delete privileges by sending DELETE requests to the /ports/purge endpoint. By utilizing...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109357

LibreNMS versions before 26.9.0 are vulnerable to an LDAP filter injection in ldap-authorization and ad-authorization modes. The root cause is the insertion of unescaped usernames into LDAP search filters combined with an authentication mechanism that only verifies user existence. If REMOTE_USER ...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...