CVE-2026-84192 — LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacke…
Published: 2026-09-01 · CVSS: 7.1 · CVSS 4.0
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7