https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 14:13:59 +0000 https://db.gcve.eu/vuln/bdu:2026-16524 bdu:2026-16524 https://db.gcve.eu/vuln/bdu:2026-16524 https://db.gcve.eu/vuln/fkie_cve-2026-109352 <p>LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device&#39;s SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device&#39;s Wireless tab, enabling session hijacking.</p> <p>LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device&#39;s SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device&#39;s Wireless tab, enabling session hijacking.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109352 https://db.gcve.eu/vuln/ghsa-4f47-pwgv-rph4 <p>LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device&#39;s SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device&#39;s Wireless tab, enabling session hijacking.</p> <p>LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device&#39;s SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device&#39;s Wireless tab, enabling session hijacking.</p> https://db.gcve.eu/vuln/ghsa-4f47-pwgv-rph4