LibreNMS contains an authenticated SQL Injection vulnerability

MEDIUM 6.5CVE-2020-36947 · GHSA-qp2j-v5jg-hg68 · Published 27/01/2026 · updated 08/10/2026

Package	Affected versions	Patched versions
librenms/librenms Packagist	`≤ 1.46`	No fix yet
librenms librenms	`= 1.46`	No fix yet

Description

LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.

NVD description

LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.

References

nvd.nist.gov/vuln/detail/CVE-2020-36947 · ADVISORY
community.librenms.org · WEB
librenms/librenms · PACKAGE
exploit-db.com/exploits/49246 · WEB
vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection · WEB
community.librenms.org · Product
librenms.org · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free