CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109353

LibreNMS versions before 26.9.0 are vulnerable to an SQL injection flaw within the notifications.inc.php component. This vulnerability allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter . Successful exploitation enables attackers to perform cross-table ...

CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...