CVE-2021-43324

LibreNMS through 21.10.2 allows XSS via a widget title...

Cross site scripting

LibreNMS through 21.10.2 allows XSS via a widget title...

CVE-2021-43324

LibreNMS through 21.10.2 allows XSS via a widget title...

CVE-2021-43324

CVE-2021-43324 affects LibreNMS up to version 21.10.2, where a lack of sanitization in the widget title allows cross-site scripting (XSS) in the web UI. The vulnerability enables injection of malicious script into widget titles, with the exploit details not provided in the supplied documents. Sev...

Librenms 跨站脚本漏洞

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . A cross-site scripting vulnerability exists in LibreNMS 21.10.2 and earlier versions. An attacker can exploit the vulnerability to inject code via a widget header...

Cross-site Scripting in LibreNMS

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

GHSA-2R2W-JRH2-P4GR Cross-site Scripting in LibreNMS

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2021-93896)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool. a stored cross-site scripting vulnerability exists in API access pages in versions of LibreNMS prior to 21.3.0. The vulnerability stems from insufficient validation of the $api-description variable. An attacker could use this...

CVE-2021-31274

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

CVE-2021-31274

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

Cross site scripting

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

Exposure of Resource to Wrong Sphere in LibreNMS

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

GHSA-3C33-3465-FHX2 Exposure of Resource to Wrong Sphere in LibreNMS

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

CVE-2021-31274

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

CVE-2021-31274

In LibreNMS description variable, allowing arbitrary Javascript execution. This is the concrete issue tracked as CVE-2021-31274 across multiple feeds. Affected component: API Access handling in LibreNMS; root cause: inadequate input sanitization for the description field. Impact as described: pot...

Librenms 跨站脚本漏洞

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool. a stored cross-site scripting vulnerability exists in API access pages in versions of LibreNMS prior to 21.3.0. The vulnerability stems from insufficient validation of the $api-description variable. An attacker could use this...

SQL Injection in librenms

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

GHSA-H59F-P56G-G75V SQL Injection in librenms

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

LibreNMS SQL Injection Vulnerability (CNVD-2021-12100)

Librenms is an open source network monitoring system based on PHP and MySQL from the Librenms community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A SQL injection vulnerability exists in LibreNMS versions prior to 21.1.0, which...

CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...