GitHub Advisoryadvisory · Packagist

GHSA-qp2j-v5jg-hg68 LibreNMS contains an authenticated SQL Injection vulnerability

HIGH Published 2026-01-27 Modified 2026-02-02 Official page ↗
Aliases
CVE-2020-36947
Ecosystem
Packagist
Packages
librenms/librenms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-89
Reviewed
2026-02-02

Affected packages

• Packagist librenms/librenms: <= 1.46 (no fix yet)

Description

LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.

Related

Alias · CVE (1)

  • CVE-2020-36947 LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References