Cross-site Scripting Vulnerability in LibreNMS Affected by Administrative Access
CVE-2026-2728
4.6MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-2728?
LibreNMS versions prior to 26.3.0 have a vulnerability that allows authenticated users with administrative privileges to exploit cross-site scripting (XSS) on the showconfig page. This flaw can lead to unauthorized actions being taken against other users accessing the page, as attackers can potentially execute harmful scripts within the context of their browsers.
Affected Version(s)
librenms 0 < 26.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.