Iniciar sesión
Deutsch English Español Polski
Media

LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability

  • Publicada: 16.01.2025
  • Actualizado: 11.10.2026 10:22

StoredXSS-LibreNMS-Display Name 2

Description:

XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):/device/$DEVICE_ID/edit -> param: display

of Librenms versions 24.11.0 (https://github.com/librenms/librenms) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.

Proof of Concept:

  1. Add a new device through the LibreNMS interface.
  2. Edit the newly created device by going to the "Device Settings" section.
  3. In the "Display Name" field, enter the following payload: "><img src onerror="alert(document.cookie)">. image
  4. Save the changes.
  5. The XSS payload is triggered when navigating to the path /device/$DEVICE_ID/logs and hovering over a type containing a tag (such as Core 1 in the image). image

Impact:

Execution of Malicious Code

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer librenms/librenms >= 24.11.10, < 24.12.0 24.12.0

Referencias

Puntuación CVSS 4.6/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Debilidad (CWE)
CWE-79
Plataforma
Composer
Paquete
librenms/librenms
Publicada
16.01.2025
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-2f4w-6mc7-4w78 - CC BY 4.0

Historial de vulnerabilidades: librenms/librenms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (106) en el archivo
Entradas en total
106
Primera → última
10.2019 08.2026
Sin corrección
6
Explotada en ataques
0

Distribución por gravedad

  • Crítica 5
  • Alta 39
  • Media 56
  • Baja 6

Divulgaciones por año

Gravedad:
  1. LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
    Alta · 7.1 CVE-2026-84192 < 26.5.0 26.5.0
  2. LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
    Alta · 8.1 CVE-2026-84189 < 26.7.0 26.7.0
  3. LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
    Alta CVE-2026-55182 >= 21.6.0, < 26.5.0 26.5.0
  4. LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
    Alta CVE-2026-6204 >= 1.48, < 26.3.0 26.3.0
  5. LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
    Alta · 8.8 CVE-2026-26990 < 26.2.0 26.2.0
  6. LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.
    Alta CVE-2026-26988 < 26.2.0 26.2.0
  7. LibreNMS contains an authenticated SQL Injection vulnerability
    Alta · 7.1 CVE-2020-36947 <= 1.46 sin corrección
  8. LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE
    Alta · 7.5 CVE-2025-54138 < 25.7.0 25.7.0
  9. LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability esta entrada
    Media · 4.6 CVE-2024-56144 >= 24.11.10, < 24.12.0 24.12.0
  10. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php
    Alta · 7.5 CVE-2024-52526 < 24.10.0 24.10.0
  11. LibreNMS has an Authenticated OS Command Injection
    Crítica · 9.1 CVE-2024-51092 < 24.10.0 24.10.0
  12. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php
    Alta · 7.5 CVE-2024-51497 < 24.10.0 24.10.0
  13. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php
    Alta · 7.5 CVE-2024-51496 < 24.10.0 24.10.0
  14. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php
    Alta · 7.5 CVE-2024-51495 < 24.10.0 24.10.0
  15. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    Alta · 7.5 CVE-2024-51494 < 24.10.0 24.10.0
  16. LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
    Alta · 7.2 CVE-2024-50355 < 24.10.0 24.10.0
  17. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
    Alta · 7.5 CVE-2024-50352 < 24.10.0 24.10.0
  18. LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php
    Alta · 7.5 CVE-2024-50351 < 24.10.0 24.10.0
  19. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
    Alta · 7.5 CVE-2024-50350 < 24.10.0 24.10.0
  20. LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php
    Alta · 7.5 CVE-2024-49764 < 24.10.0 24.10.0
  21. Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php
    Alta · 7.5 CVE-2024-49759 < 24.10.0 24.10.0
  22. LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
    Alta · 7.5 CVE-2024-49754 < 24.10.0 24.10.0
  23. LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name
    Alta · 7.2 CVE-2024-47524 < 24.9.0 24.9.0
  24. LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction
    Alta · 7.2 CVE-2024-32480 < 24.4.0 24.4.0
  25. LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS
    Alta · 7.1 CVE-2024-32479 < 24.4.0 24.4.0
  26. LibreNMS vulnerable to SQL injection time-based leads to database extraction
    Alta · 8.8 CVE-2024-32461 < 24.4.0 24.4.0
  27. SQL injection in librenms/librenms
    Alta · 7.8 CVE-2023-5591 < 23.10.0 23.10.0
  28. Cross site scripting in librenms
    Alta · 8.4 CVE-2023-5060 < 23.9.1 23.9.1
  29. LibreNMS Cross-site Scripting vulnerability
    Alta · 7.6 CVE-2023-4347 < 23.8.0 23.8.0
  30. Deserialization of Untrusted Data in librenms/librenms
    Alta · 8.8 CVE-2022-3525 < 22.10.0 22.10.0
  31. Cross-site Scripting in librenms/librenms
    Alta · 7.6 CVE-2022-4068 < 22.10.0 22.10.0
  32. Insufficient Session Expiration in librenms/librenms
    Crítica · 9.8 CVE-2022-4070 < 22.10.0 22.10.0
  33. Command injection in librenms
    Alta CVE-2022-29712 < 22.4.0 22.4.0
  34. LibreNMS Information Disclosure
    Crítica · 9.8 CVE-2019-10665 <= 1.47 sin corrección
  35. LibreNMS arbitrary OS commands execution
    Crítica · 9.8 CVE-2018-20434 = 1.46 sin corrección
  36. LibreNMS SQL Injection
    Alta · 8.8 CVE-2018-20678 < 1.65 1.65
  37. Improper Access Control in librenms
    Alta · 7.1 CVE-2022-0580 < 22.2.0 22.2.0
  38. Improper Authorization in librenms
    Alta · 7.1 CVE-2022-0587 < 22.2.0 22.2.0
  39. Path traversal in librenms/librenms
    Crítica · 9.8 CVE-2021-44278 <= 21.11.0 sin corrección
  40. Exposure of Resource to Wrong Sphere in LibreNMS
    Alta · 8.8 CVE-2020-15877 < 1.65.1 1.65.1
  41. SQL Injection in librenms
    Alta · 8.8 CVE-2020-35700 < 21.1.0 21.1.0
  42. SQL Injection in LibreNMS
    Alta · 8.8 CVE-2019-10671 < 1.50.1 1.50.1
  43. SQL Injection in LibreNMS
    Alta · 8.1 CVE-2019-12465 < 1.53 1.53
  44. Path Traversal in LibreNMS
    Alta · 7.5 CVE-2019-12464 < 1.53 1.53
  45. Improper Encoding or Escaping of Output and Injection in LibreNMS
    Alta · 8.8 CVE-2019-12463 >= 1.50.1, < 1.53 1.53

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.