CVE-2026-26988
中文标题:
（暂无数据）
英文标题:
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
漏洞描述
中文描述:
（暂无数据）
英文描述:
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| librenms | librenms | < 26.2.0 | - | - |
cpe:2.3:a:librenms:librenms:<_26.2.0:*:*:*:*:*:*:*
|
| librenms | librenms | * | - | - |
cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
CVSS评分详情
4.0 (cna)
CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2026-26988 |
2026-02-20 03:19:39 | 2026-02-19 22:00:03 |
| NVD | nvd_CVE-2026-26988 |
2026-02-21 02:00:04 | 2026-02-20 22:00:05 |
版本与语言
安全公告
变更历史
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']