CVE-2026-84193 | BDVDB-2026-367132 Detail

Description#

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-01Record published in the CVE List.
2. Version 22026-09-02Most recent update recorded in the CVE List.