CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2026-6204 | High | 7.2 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand… |
CVE-2026-2728 | Medium | 4.8 | 2026-04-13 | LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires ad… |
CVE-2026-26992 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the port group name is not sanitized, allowing atta… |
CVE-2026-26991 | Medium | 4.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not sanitized, allowing at… |
CVE-2026-27016 | Medium | 5.4 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit paramet… |
CVE-2026-26990 | High | 8.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in… |
CVE-2026-26989 | Medium | 4.3 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vu… |
CVE-2026-26988 | Critical | 9.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_tab… |
CVE-2026-26987 | Medium | 6.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email fie… |
CVE-2020-36947 | High | 7.1 | 2026-01-27 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database infor… |
CVE-2025-68614 | Medium | 4.3 | 2025-12-23 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site s… |
CVE-2025-65093 | Medium | 5.5 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was i… |
CVE-2025-65014 | Low | 3.7 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in… |
CVE-2025-65013 | Medium | 6.2 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability wa… |
CVE-2025-62412 | Low | 3.8 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts > Alert Rules page is not properly sanitized, and can… |
CVE-2025-62411 | Medium | 5.5 | 2025-10-16 | LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Ale… |
CVE-2025-62365 | Medium | 6.1 | 2025-10-13 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to 25.7.0, there is a reflected-XSS in `report_this` function in `librenms/in… |
CVE-2025-55296 | Medium | 5.5 | 2025-08-18 | librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the A… |
CVE-2025-54138 | High | 7.5 | 2025-07-22 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Libr… |
CVE-2025-47931 | Medium | 6.1 | 2025-05-17 | LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the… |
CVE-2025-23201 | Medium | 5.4 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost`… |
CVE-2025-23200 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `ajax_form.php` -> param… |
CVE-2025-23199 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param… |
CVE-2025-23198 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2024-56144 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2024-53457 | Medium | 5.4 | 2024-12-05 | A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scri… |
CVE-2024-52526 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" tab of the Devi… |
CVE-2024-51497 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Custom OID" tab of a devi… |
CVE-2024-51496 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of t… |
CVE-2024-51495 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allow… |
CVE-2024-51494 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-50355 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not… |
CVE-2024-50352 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the… |
CVE-2024-50351 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "section" parameter of… |
CVE-2024-50350 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allow… |
CVE-2024-49764 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information… |
CVE-2024-49759 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page… |
CVE-2024-49758 | Medium | 4.8 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sa… |
CVE-2024-49754 | High | 7.5 | 2024-11-15 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows aut… |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-47527 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feat… |
CVE-2024-47526 | Low | 3.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" featu… |
CVE-2024-47525 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allo… |
CVE-2024-47524 | High | 7.2 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly s… |
CVE-2024-47523 | High | 7.5 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature… |
CVE-2024-32480 | High | 7.2 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is… |
CVE-2024-32479 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the `Service` template n… |
CVE-2024-32461 | High | 7.1 | 2024-04-22 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to… |
CVE-2023-48294 | Medium | 4.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-46745 | Medium | 5.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48295 | Medium | 6.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affe… |
CVE-2023-5591 | Medium | 6.5 | 2023-10-16 | SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. |
CVE-2023-5060 | Medium | 6.1 | 2023-09-19 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1. |
CVE-2023-4982 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4981 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4980 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4979 | Medium | 5.4 | 2023-09-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4978 | Medium | 6.1 | 2023-09-15 | Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4977 | Medium | 5.4 | 2023-09-15 | Code Injection in GitHub repository librenms/librenms prior to 23.9.0. |
CVE-2023-4347 | Medium | 5.4 | 2023-08-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. |
CVE-2022-4070 | Critical | 9.8 | 2022-11-20 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4069 | Medium | 4.8 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4068 | Medium | 5.4 | 2022-11-20 | A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sa… |
CVE-2022-4067 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3562 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3561 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3525 | High | 8.8 | 2022-11-20 | Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3516 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3231 | Medium | 5.4 | 2022-09-17 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. |
CVE-2022-36746 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. |
CVE-2022-36745 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. |
CVE-2022-29712 | Critical | 9.8 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. |
CVE-2022-29711 | Medium | 6.1 | 2022-06-02 | LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. |
CVE-2022-0772 | Medium | 4.8 | 2022-02-27 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2. |
CVE-2022-0589 | Medium | 5.4 | 2022-02-15 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0588 | High | 7.1 | 2022-02-15 | Missing Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0587 | Medium | 6.5 | 2022-02-15 | Improper Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0580 | High | 7.1 | 2022-02-14 | Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0576 | Medium | 6.1 | 2022-02-14 | Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0575 | Medium | 5.4 | 2022-02-14 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0. |
CVE-2021-44278 | Critical | 9.8 | 2021-12-03 | Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. |
CVE-2021-44279 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php. |
CVE-2021-44277 | Medium | 6.1 | 2021-12-01 | Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php. |
CVE-2021-43324 | Medium | 6.1 | 2021-11-03 | LibreNMS through 21.10.2 allows XSS via a widget title. |
CVE-2021-31274 | Medium | 5.4 | 2021-09-08 | In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a… |
CVE-2020-35700 | High | 8.8 | 2021-02-08 | A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authentic… |
CVE-2020-15877 | High | 8.8 | 2020-07-21 | An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware'… |
CVE-2020-15873 | Medium | 6.5 | 2020-07-21 | In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php. |
CVE-2019-12465 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in… |
CVE-2019-12464 | High | 7.5 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in… |
CVE-2019-12463 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.p… |
CVE-2019-10671 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An auth… |
CVE-2019-10670 | Medium | 6.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is parti… |
CVE-2019-10669 | High | 7.2 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplie… |
CVE-2019-10668 | Critical | 9.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. S… |
CVE-2019-10667 | Medium | 5.3 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose l… |
CVE-2019-10666 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input wit… |
CVE-2019-10665 | Critical | 9.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/gr… |
CVE-2019-15230 | Medium | 5.4 | 2019-08-28 | LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin conso… |