9 matches found
CVE-2026-109355
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355 LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355 LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355 LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355
LibreNMS versions before 26.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the get_oxidized_nodes_list() function. The root cause is the rendering of Oxidized API fields and SNMP sysName without proper escaping. An attacker who can control the Oxidized response or ...
EUVD-2026-97657
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
CVE-2026-109355: Improper Neutralization of Input During Web Page Generation
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...
PT-2026-110772
Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description A stored cross-site scripting issue exists in the get oxidized nodes list function. The application fails to escape Oxidized API fields and the SNMP sysName variable. An attacker who can control th...