60 matches found
CVE-2025-27590
CVE-2025-27590 - PoC 익스플로잇 멀티파트 폼 업로드를 통한 명령 주입 📌 설명 이는 CVE-2025-27590 에 대한 개념 증명PoC 익스플로잇으로, 멀티파트 파일 업로드를 적절한 위생 처리 없이 처리하는 웹 애플리케이션에 영향을 미치는 명령 주입 취약점입니다. 이 취약점으로 인해 원격 공격자는 악의적인 form-data 페이로드를 조작하여 임의의 셸 명령을 실행할 수 있습니다. 🧠 취약점 요약 유형 : 명령 주입 벡터 : HTTP multipart/form-data 영향받는 파라미터 : cloginrc 및...
CVE-2026-84189
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
EUVD-2026-69026
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
CVE-2026-84189
LibreNMS through 26.4.0 is affected by a stored XSS in the Oxidized integration . JSON fields (name , ip , model , author , commit message ) returned by the admin-configurable oxidized.url are rendered into the device showconfig page without htmlspecialchars(). An administrator who points the Oxi...
CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
CVE-2026-84189: Improper Neutralization of Input During Web Page Generation
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
PT-2026-84152
LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...
WS-2026-0037
The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an...
GHSA-7GWW-X7FH-JF9J LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Summary The Oxidized integration URL oxidized.url is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields name, ip, model, author, commit message into HTML without htmlspecialchars. An admin pointing the URL at an attacker-controlled server...
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
Summary The Oxidized integration URL oxidized.url is admin-configurable. LibreNMS fetches device info and version history from that URL and renders JSON fields name, ip, model, author, commit message into HTML without htmlspecialchars. An admin pointing the URL at an attacker-controlled server...
Server-side Request Forgery (SSRF)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of JSON fields from an external API response in the device...
MAL-2026-10896 Malicious code in flow-eslint-oxidized (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in flow-eslint-oxidized (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in flow-parser-oxidized (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 656e2f1d3b8c65b9726bb52918453404799c461b0db5ae89061e6b740aa4862d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4294 Malicious code in flow-parser-oxidized (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 656e2f1d3b8c65b9726bb52918453404799c461b0db5ae89061e6b740aa4862d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview flow-parser-oxidized is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...