CVE-2023-5591

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

CVE-2022-4069

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-4067

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-4070

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-0575

Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...

CVE-2022-0576

Cross-site Scripting XSS - Generic in Packagist librenms/librenms prior to 22.1.0...

CVE-2022-36745

LibreNMS v22.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the component print-customoid.php...

CVE-2022-36746

LibreNMS v22.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the component oxidized-cfg-check.inc.php...

CVE-2022-3562

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3516

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3231

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.9.0...

CVE-2022-29712

LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the serviceip, hostname, and serviceparam parameters...

CVE-2022-3561

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-29711

LibreNMS v22.3.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /Table/GraylogController.php...

CVE-2021-43324

LibreNMS through 21.10.2 allows XSS via a widget title...

CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

CVE-2019-10665

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

CVE-2019-10670

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

CVE-2019-10667

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...