GHSA-7GWW-X7FH-JF9J LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Summary The Oxidized integration URL oxidized.url is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields name, ip, model, author, commit message into HTML without htmlspecialchars. An admin pointing the URL at an attacker-controlled server...

GHSA-7CJ5-V4PP-V632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

Summary The graphdescr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...

GHSA-JF24-8G2H-2WG7 LibreNMS Vulnerable to Remote Code Execution via AboutController

Remote Code Execution via AboutController in LibreNMS Summary A Remote Code Execution RCE vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about...

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only striptags applied directly into $pagetitle. A single quote terminates the JS string, executing arbitra...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the document.title assignment in JavaScript, where user-supplied GET parameters are...

PT-2026-76558

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.5.0 Description The Proxmox application view contains a reflected cross-site scripting issue. The application fails to adequately encode the instance and vmid GET parameters before reflecting them into the page...

CVE-2026-2728

LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page...

CVE-2026-6204

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in compromise of the underlying web server...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

GHSA-5GM9-622F-QCG5 LibreNMS: Cross-Site Scripting in ShowConfigController

Summary A Stored Cross-Site Scripting XSS vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the rancidrepourl configuration value. When a user navigates to a device's configuration page, this unsanitised...

EUVD-2026-21907

LibreNMS: Cross-Site Scripting in ShowConfigController...

LibreNMS: Cross-Site Scripting in ShowConfigController

Summary A Stored Cross-Site Scripting XSS vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the rancidrepourl configuration value. When a user navigates to a device's configuration page, this unsanitised...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

CVE-2024-51092

CVE-2024-51092 affects LibreNMS prior to 24.10.0 and allows an authenticated attacker to achieve arbitrary code execution via OS command injection. The root causes are: (1) AboutController.php index() returning a value from shell_exec(); (2) SettingsController.php update() validating and persisti...

CVE-2024-51092

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index, SettingsController.php's update, and PollDevice.php's initRrdDirectory...

LibreNMS: Cross-Site Scripting In ShowConfigController

Summary A Stored Cross-Site Scripting XSS vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the "rancidrepourl" configuration value. When a user navigates to a device's configuration page, this unsanitise...