← All advisories

High severity8.8OSV Advisory· Published Mar 28, 2019· Updated Jun 17, 2026

CVE-2018-20678

CVE-2018-20678

Description

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
librenms/librenmsPackagist	< 1.65	1.65

Affected products

3

Librenms/LibrenmsOSV2 versions
0.1, 1.19, 1.20, …+ 1 more
- (no CPE)range: 0.1, 1.19, 1.20, …
- cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*range: <=1.47
ghsa-coords
pkg:composer/librenms/librenms
Range: < 1.65

Patches

Vulnerability mechanics

References

6

cert.enea.pl/advisories/cert-190101.htmlnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-4fwh-r866-pvh9ghsaADVISORY
github.com/librenms/librenms/commits/master/html/ajax_table.phpnvdThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2018-20678ghsaADVISORY
github.com/librenms/librenms/commit/32f72bc1ab7e980e4070e826a89d0d36a5ba62ddghsaWEB
github.com/librenms/librenms/pull/11920ghsaWEB

News mentions

0

No linked articles in our index yet.