CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

EUVD-2020-31269

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

PT-2026-82225

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874: Improper Neutralization of Special Elements used in a Command

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

A command injection vulnerability exists in LibreNMS 1.65 . A remote authenticated attacker with normal privileges can exploit this flaw in the /graph.php API endpoint to execute arbitrary shell commands . Remediation is available in version 1.65.1 .

PT-2026-44880

Name of the Vulnerable Software and Affected Versions Open ISES Project version 3.30A Description An SQL injection flaw allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code via the p1 parameter when sending GET requests to the 'inc types...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

EUVD-2010-2547

Malware in sbrugna...

EUVD-2015-8253

Malware in sbrugna...

EUVD-2019-3885

Malware in sbrugna...

CVE-2023-48294

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48294: Exposure of Sensitive Information to an Unauthorized Actor

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

SUSE CVE-2007-6035

SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the localgraphid parameter...

SUSE CVE-2009-4032

Multiple cross-site scripting XSS vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 graph.php, 2 include/topgraphheader.php, 3 lib/htmlform.php, and 4 lib/timespansettings.php, as demonstrated by the a graphend or b graphstart...

SUSE CVE-2010-2092

SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the...

Sql injection

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-12463: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...