https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:42:39 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0562 certfr-2026-avi-0562 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0562 https://cve.radiocsirt.org/vuln/euvd-2026-290546 EUVD-2026-290546 https://cve.radiocsirt.org/vuln/euvd-2026-290546 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2728 <p>LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.</p> <p>LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2728 https://cve.radiocsirt.org/vuln/ghsa-5gm9-622f-qcg5 <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the `rancid_repo_url` configuration value. When a user navigates to a device&#39;s configuration page, this unsanitised value is rendered directly within an HTML anchor (&amp;lt;a&amp;gt;) tag. This allows an authenticated user with permission to modify external settings to inject malicious JavaScript that will execute in the browser of any user viewing the affected device pages.</p> <p>### Details The vulnerability is located in the external settings configuration block, specifically at the settings/external/rancid endpoint. When a valid rancid_configs is set, the application renders the corresponding `rancid_repo_url` as a clickable link labeled &#34;Git Repository&#34; on the `/device/{id}/showconfig` UI.</p> <p>Because the `rancid_repo_url` input is neither validated upon saving nor contextually encoded upon rendering, an attacker can break out of the `href` attribute context or use JavaScript URIs to attach malicious event handlers or scripts.</p> <p>This vulnerability is introduced by the line 13 of https://github.com/librenms/librenms/blob/master/includes/html/pages/device/showconfig.inc.php.</p> <p>### PoC 1. Login as an admin and navigate to `/settings/external/rancid`. &lt;img width=&#34;790&#34; height=&#34;155&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/348fff1b-dfce-4735-9273-055113695368&#34; /&gt;</p> <p>2. Add a valid path to…</p> <p><strong>Affected:</strong> Packagist: librenms/librenms</p> <p>### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application fails to properly sanitise the `rancid_repo_url` configuration value. When a user navigates to a device&#39;s configuration page, this unsanitised value is rendered directly within an HTML anchor (&amp;lt;a&amp;gt;) tag. This allows an authenticated user with permission to modify external settings to inject malicious JavaScript that will execute in the browser of any user viewing the affected device pages.</p> <p>### Details The vulnerability is located in the external settings configuration block, specifically at the settings/external/rancid endpoint. When a valid rancid_configs is set, the application renders the corresponding `rancid_repo_url` as a clickable link labeled &#34;Git Repository&#34; on the `/device/{id}/showconfig` UI.</p> <p>Because the `rancid_repo_url` input is neither validated upon saving nor contextually encoded upon rendering, an attacker can break out of the `href` attribute context or use JavaScript URIs to attach malicious event handlers or scripts.</p> <p>This vulnerability is introduced by the line 13 of https://github.com/librenms/librenms/blob/master/includes/html/pages/device/showconfig.inc.php.</p> <p>### PoC 1. Login as an admin and navigate to `/settings/external/rancid`. &lt;img width=&#34;790&#34; height=&#34;155&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/348fff1b-dfce-4735-9273-055113695368&#34; /&gt;</p> <p>2. Add a valid path to…</p> https://cve.radiocsirt.org/vuln/ghsa-5gm9-622f-qcg5