CVE-2020-15875 | Medium | 5.0 | 2026-09-13 | An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via… |
CVE-2026-86427 | High | 8.8 | 2026-09-07 | LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtoo… |
CVE-2026-86426 | Critical | 9.8 | 2026-09-07 | LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by s… |
CVE-2026-84194 | | | 2026-09-01 | LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt supp… |
CVE-2026-84193 | | | 2026-09-01 | LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields includ… |
CVE-2026-84192 | High | 7.1 | 2026-09-01 | LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without es… |
CVE-2026-84191 | Medium | 6.1 | 2026-09-01 | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDist… |
CVE-2026-84190 | High | 7.2 | 2026-09-01 | LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to she… |
CVE-2026-84189 | High | 8.1 | 2026-09-01 | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url… |
CVE-2026-84188 | Medium | 4.8 | 2026-09-01 | LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbati… |
CVE-2026-55182 | | | 2026-08-26 | LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal… |
CVE-2026-45694 | Medium | 5.4 | 2026-08-26 | LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting t… |
CVE-2026-80214 | | | 2026-08-26 | LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. |
CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2026-6204 | High | 7.2 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand… |
CVE-2026-2728 | Medium | 4.8 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires ad… |
CVE-2026-26992 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing atta… |
CVE-2026-26991 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing at… |
CVE-2026-27016 | Medium | 5.4 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit paramet… |
CVE-2026-26990 | High | 8.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in… |
CVE-2026-26989 | Medium | 4.3 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-26988 | Critical | 9.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_tab… |
CVE-2026-26987 | Medium | 6.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email fie… |
CVE-2020-36947 | High | 7.1 | 2026-01-27 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database infor… |
CVE-2025-68614 | Medium | 4.3 | 2025-12-23 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site s… |
CVE-2025-65093 | Medium | 5.5 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was i… |
CVE-2025-65014 | Low | 3.7 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in… |
CVE-2025-65013 | Medium | 6.2 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability wa… |
CVE-2025-62412 | Low | 3.8 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts > Alert Rules page is not properly sanitized, and can… |
CVE-2025-62411 | Medium | 5.5 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Ale… |
CVE-2025-62365 | Medium | 6.1 | 2025-10-13 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/in… |
CVE-2025-55296 | Medium | 5.5 | 2025-08-18 | librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the A… |
CVE-2025-54138 | High | 7.5 | 2025-07-22 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Libr… |
CVE-2025-47931 | Medium | 6.1 | 2025-05-17 | LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the… |
CVE-2025-23201 | Medium | 5.4 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost`… |
CVE-2025-23200 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `ajax_form.php` -> param… |
CVE-2025-23199 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param… |
CVE-2025-23198 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2024-56144 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2024-53457 | Medium | 5.4 | 2024-12-05 | A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scri… |
CVE-2024-52526 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Devi… |
CVE-2024-51497 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a devi… |
CVE-2024-51496 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of t… |
CVE-2024-51495 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allow… |
CVE-2024-51494 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-50355 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not… |
CVE-2024-50352 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the… |
CVE-2024-50351 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of… |
CVE-2024-50350 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-49764 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information… |
CVE-2024-49759 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page… |
CVE-2024-49758 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sa… |
CVE-2024-49754 | High | 7.5 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows aut… |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-47527 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feat… |
CVE-2024-47526 | Low | 3.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" featu… |
CVE-2024-47525 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allo… |
CVE-2024-47524 | High | 7.2 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly s… |
CVE-2024-47523 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature… |
CVE-2024-32480 | High | 7.2 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is… |
CVE-2024-32479 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template n… |
CVE-2024-32461 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to… |
CVE-2023-48294 | Medium | 4.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-46745 | Medium | 5.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48295 | Medium | 6.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affe… |
CVE-2023-5591 | Medium | 6.5 | 2023-10-16 | SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. |
CVE-2023-5060 | Medium | 6.1 | 2023-09-19 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. |
CVE-2023-4982 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4981 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4980 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4979 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4978 | Medium | 6.1 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4977 | Medium | 5.4 | 2023-09-15 | Code Injection in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4347 | Medium | 5.4 | 2023-08-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. |
CVE-2022-4070 | Critical | 9.8 | 2022-11-20 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4069 | Medium | 4.8 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4068 | Medium | 5.4 | 2022-11-20 | A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sa… |
CVE-2022-4067 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3562 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3561 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3525 | High | 8.8 | 2022-11-20 | Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3516 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3231 | Medium | 5.4 | 2022-09-17 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. |
CVE-2022-36746 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. |
CVE-2022-36745 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. |
CVE-2022-29712 | Critical | 9.8 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. |
CVE-2022-29711 | Medium | 6.1 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. |
CVE-2022-0772 | Medium | 4.8 | 2022-02-27 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2. |
CVE-2022-0589 | Medium | 5.4 | 2022-02-15 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0588 | High | 7.1 | 2022-02-15 | Missing Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0587 | Medium | 6.5 | 2022-02-15 | Improper Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0580 | High | 7.1 | 2022-02-14 | Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0576 | Medium | 6.1 | 2022-02-14 | Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0575 | Medium | 5.4 | 2022-02-14 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0. |
CVE-2021-44278 | Critical | 9.8 | 2021-12-03 | Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. |
CVE-2021-44279 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php. |
CVE-2021-44277 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php. |
CVE-2021-43324 | Medium | 6.1 | 2021-11-03 | LibreNMS through 21.10.2 allows XSS via a widget title. |
CVE-2021-31274 | Medium | 5.4 | 2021-09-08 | In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a… |
CVE-2020-35700 | High | 8.8 | 2021-02-08 | A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authentic… |