PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

...

PT-2019-11982

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description A command injection issue exists due to improper filtering of user-supplied parameters in the html/includes/graphs/device/collectd.inc.php file. The mysqli escape real string function is used, which...

LibreNMS Collectd Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in the Collectd graphing functionality in LibreNMS. The to and from parameters used to define the range for a graph are sanitized using the mysqliescaperealstring function, which permits backticks. These parameters are used as part...

PT-2019-11983

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.48 Description An issue in LibreNMS allows unsafe data to be injected into HTML or JavaScript contexts due to ineffective filtering of user-supplied input using the mysqli escape real string function. This can lead...