Librenms vulnerabilities
We track 18 vulnerabilities in Librenms products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest Librenms vulnerabilities
- 8.1 High severity
librenms: Improper Neutralization of Special Elements used in an LDAP Query
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauth
- 7.1 High severity
librenms: Improper Neutralization of Special Elements used in an SQL Command
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with
- 8.8 High severity
librenms: Improper Neutralization of Special Elements used in a Command
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to
- 9.8 Critical severity
librenms: Improper Authentication
LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending
- 8.6 High severity
librenms: Improper Neutralization of Special Elements used in an OS Command
LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatena
- 7.1 High severity
librenms: Improper Neutralization of Input During Web Page Generation
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through S
- 7.2 High severity
librenms: Improper Neutralization of Special Elements used in a Command
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configurat
- 8.1 High severity
librenms: Improper Neutralization of Input During Web Page Generation
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points th
- 8.6 High severity
librenms: Improper Neutralization of Special Elements used in a Command
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being
- 8.6 High severity
librenms: Improper Neutralization of Special Elements used in an OS Command
LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
- 9.1 Critical severity
Librenms: Improper Neutralization of Special Elements used in an OS Command
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
- 7.2 High severity
librenms: Improper Neutralization of Special Elements used in an OS Command
LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could result in com
- 8.8 High severity
librenms: Improper Neutralization of Special Elements used in an SQL Command
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the pref
- 9.1 Critical severity
librenms: Improper Neutralization of Special Elements used in an SQL Command
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processin
- 7.5 High severity
librenms: Improper Control of Filename for Include/Require Statement in PHP Program
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint t
- 7.2 High severity
librenms: Improper Neutralization of Special Elements used in an SQL Command
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an
- 8.8 High severity
librenms: Improper Neutralization of Special Elements used in an SQL Command
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package para
- 7.5 High severity
librenms: Improper Restriction of Excessive Authentication Attempts
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnera