CVE-2026-84193
LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.
| CWE | CWE-79 |
| Vendor | librenms |
| Product | librenms |
| Published | Sep 1, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for librenms librenms
Be the first to know when new unknown vulnerabilities affecting librenms librenms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
librenms / librenms
0 ≤ 26.2.0
References
Credits
🔍 dimashn04