CVE-2020-15874
UnknownSummary
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.
Risk Assessment
An attacker can execute arbitrary commands on the server, potentially leading to full system compromise.
Recommendation
Update LibreNMS to a version that includes a fix for this issue.
Other vulnerabilities in LibreNMS
See all- CVE-2020-15878Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.
- CVE-2020-15876Unknown
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects many files in includes/html/table.
- CVE-2024-51092Critical
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().
- CVE-2026-55182High
LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.
- CVE-2026-45694Medium
LibreNMS up to version 26.4.0 is vulnerable to reflected cross-site scripting in the Proxmox application view through user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. This issue is fixed in version 26.5.0.
- CVE-2026-80214High
LibreNMS's Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.
Original NVD description (English source)
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.