Neil Lathwood

15 exploits Active since Feb 2022
CVE-2022-0580 WRITEUP HIGH WRITEUP
Packagist librenms/librenms <22.2.0 - Info Disclosure
Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS 7.1
CVE-2022-0587 WRITEUP MEDIUM WRITEUP
Packagist librenms/librenms <22.2.0 - Info Disclosure
Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS 6.5
CVE-2022-0588 WRITEUP HIGH WRITEUP
Packagist librenms/librenms <22.2.0 - Info Disclosure
Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
CVSS 7.1
CVE-2022-0772 WRITEUP MEDIUM WRITEUP
librenms < 22.2.2 - Stored Cross-Site Scripting
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.
CVSS 4.8
CVE-2024-47526 WRITEUP LOW WRITEUP
LibreNMS < 24.9.0 - Self Cross-Site Scripting in Alert Template Name
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.
CVSS 3.5
CVE-2024-49754 WRITEUP HIGH WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via API Token Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 7.5
CVE-2024-49759 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Bill Name Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "bill_name" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill Access" dropdown in the user's "Manage Access" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-49764 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Hostname Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This vulnerability results in the execution of malicious code when the "Capture Debug Information" page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-50350 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Port Group Name Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results in the execution of malicious code when the "Port Settings" page is visited after the affected Port Group is added to a device, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-50352 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Service Name Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Services" section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when adding a service to a device. This vulnerability could result in the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-51494 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Port Settings Descr Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a device's port settings. This vulnerability can lead to the execution of malicious code when the "Port Settings" page is visited, potentially compromising the user's session and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-51495 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Authenticated Stored Cross-Site Scripting via Device Overwrite IP Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwrite_ip" parameter when editing a device. This vulnerability results in the execution of malicious code when the device overview page is visited, potentially compromising the accounts of other users. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2024-51496 WRITEUP MEDIUM WRITEUP
LibreNMS < 24.10.0 - Reflected Cross-Site Scripting via Metric Parameter
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting (XSS) vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of malicious code when a user accesses the page with a malicious "metric" parameter, potentially compromising their session and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.
CVSS 4.8
CVE-2025-47931 WRITEUP MEDIUM WRITEUP
LibreNMS < 25.5.0 - Stored Cross-Site Scripting via Poller Groups Form Group Name Parameter
LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue.
CVSS 6.1
CVE-2025-68614 WRITEUP MEDIUM WRITEUP
LibreNMS < 25.12.0 - Stored Cross-Site Scripting via Alert Rule Name
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject HTML code. This issue has been patched in version 25.12.0.
CVSS 4.3