CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

CVE-2026-26988-LibreNMS-SQLi

CVE-2026-26988 – LibreNMS Unauthenticated SQL Injection PoC Unauthenticated SQL Injection in LibreNMS ajaxtable.php via IPv6 address search parameter. Affected versions : LibreNMS ≤ 25.12.0 Fixed in : LibreNMS ≥ 26.1 commit 15429580baba03ed1dd377bada1bde4b7a1175a1 CVSS v4.0 : 9.3 Critical...

CVE-2026-30480

CVE-2026-30480: LibreNMS Local File Inclusion LFI via Path Traversal Overview A Local File Inclusion LFI vulnerability exists in the NFSen module of LibreNMS. An authenticated attacker can exploit path traversal sequences to include arbitrary PHP files from the server filesystem. Field| Value...

cs4239-cve-2020-15873

CVE-2020-15873 Proof of Concept of CVE-2020-15873 - Blind SQL Injection in Librenms librenms librenms Development Debugging LibreNMS Docker Instance 1. Obtain a shell to the container: $ sudo docker exec -it librenmsvuln /bin/bash 2. To read the logs generated by LibreNMS: $ tail -f...

CVE-2026-86426

LibreNMS CVE-2026-86426 - Full Audit & Recon Tool 📌 Description This tool is a Proof of Concept PoC and reconnaissance framework for the vulnerability CVE-2026-86426 Authentication Bypass via Type Confusion in LibreNMS. It demonstrates how an unauthenticated attacker can: 1. Bypass API...

LibreNMS REST API Unauthenticated Access Code Execution

The vulnerability related to the implementation of the REST API interface in the LibreNMS network monitoring system stems from flaws in its authentication process. Exploitation of this vulnerability could enable a remote attacker to gain unauthorized access to protected information or execute...

LibreNMS <= 26.7.0 - Unauthenticated API Access

LibreNMS = 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates. id: CVE-2026-86426 info: name: LibreNMS = 26.7.0 - Unauthenticated API Acce...

Exploit for Improper Authentication in Librenms

CVE-2026-86426 Proof of Concept / Exploit archive per CVE-2...

LibreNMS 26.7.0 REST API Authentication Bypass

LibreNMS versions through 26.7.0 contain a REST API authentication bypass caused by API token type confusion. The supplied proof of concept uses the bypass to inventory devices and retrieve accessible API and SNMP data. https://packetstorm.news/download/238027...

VulnCheck KEV: CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

Exploit for Improper Authentication in Librenms

LibreNMS CVE-2026-86426 - Full Audit & Recon Tool 📌 Descri...

LibreNMS 26.7.0 Authentication Bypass

LibreNMS versions through 26.7.0 contain an authentication bypass via API token type confusion. This proof of concept retrieves device data and uses exposed SNMP credentials for network reconnaissance. https://packetstorm.news/download/237462...

LibreNMS LDAP Authorization Full Control

The vulnerability of the “ldap-authorization” and “ad-authorization” configurations in the LibreNMS network monitoring system is related to the failure to take measures to neutralize special elements in LDAP requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, ...

LibreNMS device wireless.inc.php Privilege Escalation

The vulnerability in the device/wireless.inc.php script of the LibreNMS network monitoring system relates to the lack of security measures for the website structure. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information and increase their...

LibreNMS nfsen_channel_common.inc.php Privilege Escalation

The vulnerability of the nfsenchannelcommon.inc.php script of the LibreNMS network monitoring system is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information and...

CVE-2026-109357

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109356

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109355

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in getoxidizednodeslist that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the...

CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109354

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...