PT-2026-110772 · Git+1 · Librenms
CVE-2026-109355
·
Published
2026-10-12
·
Updated
2026-10-12
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get oxidized nodes list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Librenms