high7.1
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without es…
Impact
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.
Affected products
| Product | Affected versions |
|---|---|
| LibreNMS | before 26.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.