Skip to content
Noroxi

librenms records

106 published records for vendor librenms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
3 · 2.8%
Pre-auth RCE
3
With a fix record
90.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

106 records
  • CVE-2018-20434
    60This week

    LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    librenms · librenmsApr 24, 2019

  • CVE-2019-10669
    52Plan

    An issue was discovered in LibreNMS through 1.47.

    HighCVSS 7.2WeaponizedEPSS 81%

    librenms · librenmsSep 9, 2019

  • CVE-2022-3562
    49Plan

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 94%

    librenms · librenmsNov 20, 2022

  • CVE-2022-4067
    49Plan

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 94%

    librenms · librenmsNov 20, 2022

  • CVE-2022-4069
    47Plan

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    MediumCVSS 4.8No exploitEPSS 93%

    librenms · librenmsNov 20, 2022

  • CVE-2024-49754
    43Plan

    LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php

    MediumCVSS 5.4No exploitEPSS 72%

    librenms · librenmsNov 15, 2024

  • CVE-2023-4347
    42Plan

    Cross-site Scripting (XSS) - Reflected in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 70%

    librenms · librenmsAug 14, 2023

  • CVE-2024-32461
    41Plan

    LibreNMS vulnerable to time-based SQL injection that leads to database extraction

    HighCVSS 8.8No exploitEPSS 19%

    librenms · librenmsApr 22, 2024

  • CVE-2022-29712
    40Plan

    LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parame

    CriticalCVSS 9.8No exploitEPSS 2%

    librenms · librenmsJun 2, 2022

  • CVE-2021-44278
    39Monitor

    Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    librenms · librenmsDec 3, 2021

  • CVE-2019-10665
    39Monitor

    An issue was discovered in LibreNMS through 1.47.

    CriticalCVSS 9.8No exploitEPSS 1%

    librenms · librenmsSep 9, 2019

  • CVE-2022-4070
    39Monitor

    Insufficient Session Expiration in librenms/librenms

    CriticalCVSS 9.8No exploitEPSS 1%

    librenms · librenmsNov 20, 2022

  • CVE-2024-51092
    38Monitor

    LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),

    CriticalCVSS 9.1WeaponizedEPSS 7%

    librenms · librenmsMay 8, 2026

  • CVE-2026-86426
    37Monitor

    LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

    CriticalCVSS 9.2Proof of conceptEPSS 4%

    librenms · librenmsSep 7, 2026

  • CVE-2026-26988
    37Monitor

    LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    librenms · librenmsFeb 19, 2026

  • CVE-2020-35700
    36Monitor

    A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allo

    HighCVSS 8.8No exploitEPSS 2%

    librenms · librenmsFeb 8, 2021

  • CVE-2020-15877
    36Monitor

    An issue was discovered in LibreNMS before 1.65.1.

    HighCVSS 8.8No exploitEPSS 2%

    librenms · librenmsJul 21, 2020

  • CVE-2019-10668
    36Monitor

    An issue was discovered in LibreNMS through 1.47.

    CriticalCVSS 9.1No exploitEPSS 2%

    librenms · librenmsSep 9, 2019

  • CVE-2019-12463
    35Monitor

    An issue was discovered in LibreNMS 1.50.1.

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsSep 9, 2019

  • CVE-2018-20678
    35Monitor

    LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsMar 28, 2019

  • CVE-2019-10671
    35Monitor

    An issue was discovered in LibreNMS through 1.47.

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsSep 9, 2019

  • CVE-2022-0580
    35Monitor

    Incorrect Authorization in librenms/librenms

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsFeb 14, 2022

  • CVE-2022-3525
    35Monitor

    Deserialization of Untrusted Data in librenms/librenms

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsNov 20, 2022

  • CVE-2026-26990
    35Monitor

    LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php

    HighCVSS 8.8No exploitEPSS 1%

    librenms · librenmsFeb 19, 2026

  • CVE-2024-53457
    34Monitor

    A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute

    MediumCVSS 5.4No exploitEPSS 45%

    librenms · librenmsDec 5, 2024