MEDIUM 5.8 NVD
CVE-2026-84193
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields includi
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.
References
- https://github.com/librenms/librenms/security/advisories/GHSA-v5jp-f342-234h
- https://www.vulncheck.com/advisories/librenms-through-26.2.0-stored-cross-site-scripting-v
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-09-01 via NVD.
vulnfeed aggregates 11474 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.