Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-15878: LibreNMS lets signed‑in users steal all monitoring data
CVE-2020-15878 · published 2 months ago
Summary
Version 1.65 of LibreNMS contains a flaw in one of its web‑based reports. A user who can log in can use it to view every record stored in the monitoring database. Apply the latest LibreNMS update or limit the report’s access to trusted users.
Original advisory text
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parame...
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-89SQL Injection
Timeline
Published26 Aug 2026
Updated4 Nov 2026
First seen26 Aug 2026
Track software like this
Free during beta