Vulnerabilities in librenms

88 results
Vexday analysis

O LibreNMS acumula 74 CVEs catalogadas, sem nenhuma confirmada em exploração ativa no catálogo CISA KEV — taxa abaixo da média geral do catálogo. Ainda assim, o cenário merece atenção: a CVE mais perigosa identificada, CVE-2022-3562, apresenta EPSS de 0,9422, indicando altíssima probabilidade estatística de exploração, e há 2 vulnerabilidades com PoC pública disponível, o que reduz a barreira técnica para atacantes. A falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode ser encadeado com outras fraquezas para escalada de impacto em aplicações de monitoramento de rede com acesso privilegiado. Equipes que mantêm instâncias do LibreNMS devem priorizar a remediação da CVE-2022-3562 e revisar exposições relacionadas a XSS, especialmente em ambientes acessíveis externamente.

CVE-2022-4070LOWInsufficient Session Expiration in librenms/librenmsEPSS 0.6%CVE-2023-5060HIGHCross-site Scripting (XSS) - DOM in librenms/librenmsEPSS 0.6%CVE-2024-47523HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" featureEPSS 0.6%CVE-2022-0772MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.6%CVE-2026-84190HIGHLibreNMS before 26.5.0 Remote Code Execution via AboutControllerEPSS 0.6%CVE-2023-46745MEDIUMRate limiting Bypass on login page in libreNMSEPSS 0.6%CVE-2022-3561MEDIUMCross-site Scripting (XSS) - Generic in librenms/librenmsEPSS 0.6%CVE-2023-48295MEDIUMCross-site Scripting at Device groups Deletion feature in LibreNMSEPSS 0.6%CVE-2024-47524HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" NameEPSS 0.5%CVE-2023-4977HIGHCode Injection in librenms/librenmsEPSS 0.5%CVE-2024-47527HIGHLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.phpEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2024-47526LOWLibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.phpEPSS 0.5%CVE-2024-52526MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phpEPSS 0.5%CVE-2020-36947HIGHLibreNMS 1.46 - MAC Accounting Graph Authenticated SQL InjectionEPSS 0.4%CVE-2026-80214HIGHLibreNMS Virtualisation Discovery Module RCEEPSS 0.4%CVE-2024-51496MEDIUMLibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.phpEPSS 0.4%CVE-2025-23201MEDIUMReflected Cross-site Scripting on error alert in librenmsEPSS 0.4%CVE-2024-49759MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.phpEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%