CVE-2026-109354: Improper Limitation of a Pathname to a Restricted Directory

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

PT-2026-110771

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description A path traversal issue exists in the nfsen channel common.inc.php file. Authenticated users can read unauthorized RRD Round Robin Database data by injecting ../ sequences into the channel parameter...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874: Improper Neutralization of Special Elements used in a Command

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

PT-2026-82225

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

EUVD-2020-31269

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

CVE-2020-15874

A command injection vulnerability exists in LibreNMS 1.65 . A remote authenticated attacker with normal privileges can exploit this flaw in the /graph.php API endpoint to execute arbitrary shell commands . Remediation is available in version 1.65.1 .

CVE-2020-15874

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint...

Elastix - graph.php LFI Detection

Detects Elastix vtigercrm/graph.php currentlanguage LFI to /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastix ...

vtiger CRM - graph.php OrganizationConfig Auth Bypass Detection

Detects vtiger = 5.2.1 auth bypass by requesting graph.php?module=Settings&action=OrganizationConfig and matching Company Details. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vtiger = 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PT-2026-44880

Name of the Vulnerable Software and Affected Versions Open ISES Project version 3.30A Description An SQL injection flaw allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code via the p1 parameter when sending GET requests to the 'inc types...

CVE-2019-12240

The Virim plugin 0.4 for WordPress allows Insecure Deserialization via svalues, tvalues, or cvalues in graph.php...

EUVD-2010-2547

Malware in sbrugna...

EUVD-2015-8253

Malware in sbrugna...

EUVD-2019-3885

Malware in sbrugna...

CVE-2023-48294

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48294

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...