In breve
- CVE-2026-26987 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda librenms/librenms, librenms (librenms).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.34%, superiore al 27.0% delle vulnerabilità.
- Correzione: aggiornare a 26.2.0 o successiva.
Description
Summary
reflected xss via email field
Details
- visit
http://127.0.0.1/settings/alerting/email
- in the email address input but this payload
<img src=1 onerror=alert(document.cookie)>
- notice the alert
PoC
Impact
can lead to ATO
NVD description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free