CVE-2026-2728

CVSS Score & Metrics

Base Score

3.5 / 10

Vulnerability Description

LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.

Vulnerability Details

Published Date

April 13, 2026

Last Modified

May 18, 2026

CWE ID

CWE-79

Source

NVD

Vendor

composer

Product

librenms/librenms

External References

https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment