CVE-2026-108715

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

EUVD-2026-96989

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715

LibreNMS versions through 26.9.1.1 are affected by an authorization bypass vulnerability in the includes/html/graphs/smokeping/auth.inc.php component. The root cause is an incorrect authorization check that validates the src probe device instead of the rendered target device . Consequently, restr...

CVE-2026-108715 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

CVE-2026-108715: Authorization Bypass Through User-Controlled Key

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokepingin or smokepingout graphs with arbitrar...

PT-2026-110118

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.1.2 Description An authorization bypass exists in the file includes/html/graphs/smokeping/auth.inc.php. The system incorrectly validates the source probe device rather than the rendered target device. This allow...

PT-2026-99369

Name of the Vulnerable Software and Affected Versions Adminer versions 5.5.1 through 6.0.1 Description An issue exists in the host port function within adminer/include/functions.inc.php where the login server string is improperly parsed. The port capture group requires digits anchored to the end ...

CVE-2026-25476: Insufficient Session Expiration

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in library/auth.inc.php runs only when skiptimeoutreset is not present in the request. When skiptimeoutreset=1 is sent, the entire block th...

CVE-2007-10002

A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/loginpassword/LANG leads to sql injection. The attack may be launched remotely. The name of the...

CVE-2015-10129

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

CVE-2015-10129

CVE-2015-10129 affects planet-freo up to 20150116. A vulnerability exists in admin/inc/auth.inc.php where manipulation of the auth argument leads to an incorrect comparison. The attack could be launched remotely; exploit has been disclosed to the public. The patch is identified as 6ad38c58a45642e...

CVE-2015-10129 planet-freo auth.inc.php comparison

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

CVE-2015-10129 planet-freo auth.inc.php comparison

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

PT-2024-10562

Name of the Vulnerable Software and Affected Versions planet-freo up to 20150116 Description A vulnerability was found in the file admin/inc/auth.inc.php, where the manipulation of the auth argument leads to incorrect comparison. The attack can be launched remotely, with a rather high complexity...

CVE-2015-10129: Incorrect Comparison

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

CVE-2007-10002 web-cyradm auth.inc.php sql injection

A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/loginpassword/LANG leads to sql injection. The attack may be launched remotely. The name of the...

CVE-2007-10002: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/loginpassword/LANG leads to sql injection. The attack may be launched remotely. The name of the...

CVE-2010-4779: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouchsettings parameter to include/adsense-new.php. NOTE: some of these details are obtained from...

WordPress WPtouch Plugin <= 1.9.20 - XSS

Because of this vulnerability in lib/includes/auth.inc.php, the attackers can inject arbitrary web script or HTML via the "wptouchsettings" parameter to include/adsense-new.php. Solution Update the plugin...