https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:50:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2024-49758 <p>LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device&#39;s Notes, its will be trigger. This vulnerability is fixed in 24.10.0.</p> <p>LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device&#39;s Notes, its will be trigger. This vulnerability is fixed in 24.10.0.</p> https://db.gcve.eu/vuln/fkie_cve-2024-49758 https://db.gcve.eu/vuln/ghsa-c86q-rj37-8f85 <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary</p> <p>The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code.</p> <p>### Details</p> <p>User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device&#39;s Notes, its will be trigger.</p> <p>### PoC</p> <p>1. As an admin user, enable the ExamplePlugin.</p> <p></p> <p>2. Add the payload `&lt;img src=&#34;x&#34; onerror=&#34;alert(document.cookie)&#34;&gt;` into the device Notes</p> <p></p> <p>3. Once visit the Overview of the Device, a pop-up will show up.</p> <p></p> <p>### Impact</p> <p>It could allow authenticated users to execute arbitrary JavaScript code in the context of other users&#39; sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.</p> <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary</p> <p>The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code.</p> <p>### Details</p> <p>User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device&#39;s Notes, its will be trigger.</p> <p>### PoC</p> <p>1. As an admin user, enable the ExamplePlugin.</p> <p></p> <p>2. Add the payload `&lt;img src=&#34;x&#34; onerror=&#34;alert(document.cookie)&#34;&gt;` into the device Notes</p> <p></p> <p>3. Once visit the Overview of the Device, a pop-up will show up.</p> <p></p> <p>### Impact</p> <p>It could allow authenticated users to execute arbitrary JavaScript code in the context of other users&#39; sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.</p> https://db.gcve.eu/vuln/ghsa-c86q-rj37-8f85