CVE-2026-109353

7.1 HIGHpublic exploit available

Published 2026-10-12 · Updated 2026-10-15

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/librenms/librenms/security/advisories/GHSA-2pw7-8mmj-gcw5
https://github.com/librenms/librenms/security/advisories/GHSA-2pw7-8mmj-gcw5

All references

https://github.com/librenms/librenms/security/advisories/GHSA-2pw7-8mmj-gcw5
https://www.vulncheck.com/advisories/librenms-before-26.9.0-sql-injection-via-notification-id-in-notifications-inc-php
https://github.com/librenms/librenms/security/advisories/GHSA-2pw7-8mmj-gcw5

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2015-20122
HIGHCVE-2019-25776PoC
HIGHCVE-2021-48008
HIGHCVE-2022-4997
CRITICALCVE-2023-54399
CRITICALCVE-2023-54400PoC
HIGHCVE-2025-45871PoC
HIGHCVE-2025-46773

Related by shared AI tags and CWE weakness class. Browse the full archive.