Loading story…
A blind SQL injection vulnerability tracked as CVE-2020-15873 affects LibreNMS 1.64.1, allowing an authenticated attacker to extract arbitrary information from the monitoring platform’s database. The flaw stems from insufficient input sanitization in customoid.inc.php, where the device_id POST parameter sent to ajax_form.php can be manipulated to inject SQL statements.
Researchers reported that the issue can be exploited as a time-based blind SQL injection, using delayed responses to infer data such as database version details and potentially recover the full contents of the LibreNMS database. LibreNMS is an open-source, community-maintained network monitoring system hosted on GitHub, and the recommended mitigation is to remediate the vulnerable code path by using parameterized queries.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A blind SQL injection vulnerability, tracked as CVE-2020-15873, was identified in LibreNMS version 1.64.1. The flaw affects customoid.inc.php via the device_id POST parameter sent to ajax_form.php and can allow an authenticated attacker to extract arbitrary database contents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity stored cross-site scripting vulnerability, **GHSA-7w8c-qgxg-m7jx** (CWE-79), affects LibreNMS legacy PHP templates that render monitoring data without consistent output encoding. Attackers able to control SNMP metadata, spoof Syslog messages, or supply crafted BGP descriptions can store JavaScript payloads that execute when administrators view device-health, routing, or event-log pages, potentially compromising administrator browser sessions and enabling session takeover. Organizations should update LibreNMS and related packages to version **26.5.0** or later; Tenable Cloud Security plugin **446367** can identify affected `librenms/librenms` deployments. Developers should apply contextual output encoding, including Laravel's `e()` helper or escaped Blade `{{ ... }}` syntax rather than raw output, and deploy a restrictive Content Security Policy as defense in depth. No known exploitation has been reported.
Aug 26, 2026
A high-severity blind SQL injection vulnerability tracked as **`CVE-2026-71287`** was disclosed in **Cacti**, where insufficient sanitization in the `sanitize_sql_column()` function allows attacker-controlled input to reach raw `ORDER BY` clauses. The flaw affects multiple pages, including `user_log.php`, `utilities.php`, `user_domains.php`, and `user_group_admin.php`, through the `sort_column` GET parameter. Because the regex-based allowlist still permits characters needed for SQL time-delay functions, an authenticated user can trigger time-based blind SQL injection against the Cacti database. The issue was assigned a **CVSS 3.1 score of 8.8** and mapped to **`CWE-89`**, with exploitation possible by any authenticated Cacti account regardless of privilege level. Activity in the upstream **Cacti** GitHub repository shows broader security remediation work around SQL injection and `ORDER BY` parameter sanitization, alongside other hardening changes, indicating the project is actively addressing input-validation weaknesses and related web application security risks in the codebase.
Aug 6, 2026
CERT Polska disclosed three vulnerabilities in **LMS (LAN Management System)**, including two high-severity issues tracked as `CVE-2026-40455` and `CVE-2026-40456`. The first is an authenticated SQL injection in `tarifflist.php` before commit `4cb30a7`, caused by insufficient sanitization of the POST `tg[]` parameter and unsafe query construction with `implode()`, allowing attackers to extract sensitive database information. The second is an OS command injection before commit `9fcb4de`, where an IP address parameter is passed to `exec()` without proper validation, enabling arbitrary operating system command execution. CERT Polska also reported `CVE-2026-40457`, a reflected XSS flaw in `dbrecover.php` and `netremap.php` before commit `9c5651b` that can trigger arbitrary JavaScript execution when an authenticated user opens a crafted link under certain conditions. The SQL injection and command injection bugs were both rated **High** with CVSS 4.0 base scores of **8.6**, and the disclosure credited **Tymoteusz Dominik** for responsibly reporting the issues. Organizations running LMS versions prior to the referenced commits should prioritize patching and review exposure of authenticated administrative functions.
Jun 29, 2026