CVE-2026-2728CWE-79

LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page

Medium · published April 13, 2026

CVSS v4.0
4.6
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00253 · 15.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-13T10:39Z
EPSS history
Timeline
  • 13 APR 10:39Z
    LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page
    cvelistv5