CRITICAL🇵🇱 Wersja polska

CVE-2026-26988

CVSS 9.3v4.0pub. 2026-02-20

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Librenms

    APP
    Librenms
    < 26.2.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2024-51092CRITICAL9.1PL ✓ten sam produkt

LibreNMS — zdalne wykonanie kodu przez OS command injection (RCE)

CVE-2022-4070CRITICAL9.8ten sam produkt

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.

CVE-2022-29712CRITICAL9.8ten sam produkt

LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, host...

CVE-2021-44278CRITICAL9.8ten sam produkt

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc...

CVE-2019-10665CRITICAL9.8ten sam produkt

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/...