Security Advisories - librenms/librenms

librenms/librenms Security Advisories for 24.9.1 (34)

[HIGH] LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write

PKSA-crbw-6n6w-1qmb CVE-2026-6204 GHSA-pr3g-phhr-h8fh

Affected version: >=1.48,<26.3.0

Reported by:
GitHub
[HIGH] LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

PKSA-fgg9-gkd1-czx2 CVE-2026-26990 GHSA-79q9-wc6p-cf92

Affected version: <26.2.0

Reported by:
GitHub
[MEDIUM] LibreNMS has a Stored XSS in Alert Rule

PKSA-p35m-1xws-mn72 CVE-2026-26989 GHSA-6xmx-xr9p-58p7

Affected version: <=25.12.0

Reported by:
GitHub
[HIGH] LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.

PKSA-rjmn-cvhz-y4dy CVE-2026-26988 GHSA-h3rv-q4rq-pqcv

Affected version: <26.2.0

Reported by:
GitHub
[MEDIUM] LibreNMS /port-groups name Stored Cross-Site Scripting

PKSA-zkdz-sv4x-6wvp CVE-2026-26992 GHSA-93fx-g747-695x

Affected version: <26.2.0

Reported by:
GitHub
[MEDIUM] LibreNMS /device-groups name Stored Cross-Site Scripting

PKSA-5ndn-cv3t-wdqt CVE-2026-26991 GHSA-5pqf-54qp-32wx

Affected version: <26.2.0

Reported by:
GitHub
[MEDIUM] LibreNMS affected by reflected xss via email field

PKSA-8m8q-njcw-35gd CVE-2026-26987 GHSA-gqx7-99jw-6fpr

Affected version: <26.2.0

Reported by:
GitHub
[MEDIUM] LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

PKSA-qmxf-dcgt-4ft3 CVE-2025-68614 GHSA-c89f-8g7g-59wj

Affected version: <25.12.0

Reported by:
GitHub
[MEDIUM] LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

PKSA-7dfn-9svk-zsqn CVE-2025-65093 GHSA-6pmj-xjxp-p8g9

Affected version: <=25.10.0

Reported by:
GitHub
[LOW] LibreNMS has Weak Password Policy

PKSA-5jjt-bqv9-rkt7 CVE-2025-65014 GHSA-5mrf-j8v6-f45g

Affected version: <25.11.0

Reported by:
GitHub
[MEDIUM] LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

PKSA-2rhd-6w4r-2261 CVE-2025-65013 GHSA-j8cq-7f6p-256x

Affected version: <25.11.0

Reported by:
GitHub
[LOW] LibreNMS alert-rules has a Cross-Site Scripting Vulnerability

PKSA-dd4d-7vsb-nysk CVE-2025-62412 GHSA-6g2v-66ch-6xmh

Affected version: <=25.8.0

Reported by:
GitHub
[MEDIUM] LibreNMS has a Stored XSS vulnerability in its Alert Transport name field

PKSA-d4tx-zpjw-46cf CVE-2025-62411 GHSA-frc6-pwgr-c28w

Affected version: <25.10.0

Reported by:
GitHub
[MEDIUM] LibreNMS is vulnerable to Reflected-XSS in `report_this` function

PKSA-hmpp-vqmr-y8ct CVE-2025-62365 GHSA-86rg-8hc8-v82p

Affected version: <=25.6.0

Reported by:
GitHub
[MEDIUM] LibreNMS allows stored XSS in Alert Template name field

PKSA-hnxn-wg5j-bmg6 CVE-2025-55296 GHSA-vxq6-8cwm-wj99

Affected version: <25.8.0

Reported by:
GitHub
[HIGH] LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

PKSA-q97j-hw3m-d3vd CVE-2025-54138 GHSA-gq96-8w38-hhj2

Affected version: <25.7.0

Reported by:
GitHub
[LOW] LibreNMS stored Cross-site Scripting vulnerability in poller group name

PKSA-zmjd-rkhn-89x6 CVE-2025-47931 GHSA-hxw5-9cc5-cmw5

Affected version: <25.5.0

Reported by:
GitHub
[MEDIUM] Librenms has a reflected XSS on error alert

PKSA-wm61-7jpt-8qtq CVE-2025-23201 GHSA-g84x-g96g-rcjc

Affected version: <=24.10.1

Reported by:
GitHub
[MEDIUM] LibreNMS Misc Section Stored Cross-site Scripting vulnerability

PKSA-j79c-gnyg-4dg2 CVE-2025-23200 GHSA-c66p-64fj-jmc2

Affected version: >=23.9.0,<24.10.1

Reported by:
GitHub
[MEDIUM] LibreNMS Ports Stored Cross-site Scripting vulnerability

PKSA-6hkp-rngj-sfhp CVE-2025-23199 GHSA-27vf-3g4f-6jp7

Affected version: <24.10.1

Reported by:
GitHub
[MEDIUM] LibreNMS Display Name Stored Cross-site Scripting vulnerability

PKSA-219w-grmd-yvrn CVE-2025-23198 GHSA-pm8j-3v64-92cq

Affected version: >=24.9.0,<24.10.1

Reported by:
GitHub
[MEDIUM] LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

PKSA-yg9q-z1cc-swz5 CVE-2024-53457 GHSA-6c5q-fg3g-qhhv

Affected version: >=24.9.0,<24.11.0

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php

PKSA-8417-9f2m-4f18 CVE-2024-52526 GHSA-8fh4-942r-jf2g

Affected version: <=24.9.1

Reported by:
GitHub
[CRITICAL] LibreNMS has an Authenticated OS Command Injection

PKSA-h2yt-ck16-pnsc CVE-2024-51092 GHSA-x645-6pf9-xwxw

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php

PKSA-dvsv-s8nn-9mk5 CVE-2024-51497 GHSA-gv4m-f6fx-859x

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php

PKSA-wh3m-km32-g613 CVE-2024-51496 GHSA-28p7-f6h6-3jh3

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

PKSA-km6n-48z2-nq7j CVE-2024-51495 GHSA-p66q-ppwr-q5j8

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

PKSA-3ph9-yzgt-sqfw CVE-2024-51494 GHSA-7663-37rg-c377

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php

PKSA-qpyt-p5td-8rqq CVE-2024-50352 GHSA-qr8f-5qqg-j3wg

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php

PKSA-zwgv-hsv9-bqx7 CVE-2024-50351 GHSA-v7w9-63xh-6r3w

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

PKSA-tkc5-5hm7-wc1w CVE-2024-50350 GHSA-xh4g-c9p6-5jxg

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

PKSA-7gfj-rwjs-mdc6 CVE-2024-49764 GHSA-rmr4-x6c9-jc68

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

PKSA-d996-rv6y-5r46 CVE-2024-49759 GHSA-888j-pjqh-fx58

Affected version: <=24.9.1

Reported by:
GitHub
[HIGH] LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php

PKSA-knhw-5drh-jk8b CVE-2024-49754 GHSA-gfwr-xqmj-j27v

Affected version: <=24.9.1

Reported by:
GitHub

librenms/librenms Security Advisories for 24.9.1 (34)

[HIGH] LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write

[HIGH] LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

[MEDIUM] LibreNMS has a Stored XSS in Alert Rule

[HIGH] LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.

[MEDIUM] LibreNMS /port-groups name Stored Cross-Site Scripting

[MEDIUM] LibreNMS /device-groups name Stored Cross-Site Scripting

[MEDIUM] LibreNMS affected by reflected xss via email field

[MEDIUM] LibreNMS Alert Rule API Cross-Site Scripting Vulnerability

[MEDIUM] LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

[LOW] LibreNMS has Weak Password Policy

[MEDIUM] LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

[LOW] LibreNMS alert-rules has a Cross-Site Scripting Vulnerability

[MEDIUM] LibreNMS has a Stored XSS vulnerability in its Alert Transport name field

[MEDIUM] LibreNMS is vulnerable to Reflected-XSS in `report_this` function

[MEDIUM] LibreNMS allows stored XSS in Alert Template name field

[HIGH] LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

[LOW] LibreNMS stored Cross-site Scripting vulnerability in poller group name

[MEDIUM] Librenms has a reflected XSS on error alert

[MEDIUM] LibreNMS Misc Section Stored Cross-site Scripting vulnerability

[MEDIUM] LibreNMS Ports Stored Cross-site Scripting vulnerability

[MEDIUM] LibreNMS Display Name Stored Cross-site Scripting vulnerability

[MEDIUM] LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php

[CRITICAL] LibreNMS has an Authenticated OS Command Injection

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php

[HIGH] LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php

[HIGH] LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

[HIGH] LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

[HIGH] Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

[HIGH] LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php