CVE-2024-49754

5.4 mediumEPSS 74%

Medium (5.4) in librenms librenms. EPSS 74% chance of exploitation in the next 30 days.

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the API-Access page allows authenticated users to inject arbitrary JavaScript through the "token" parameter when creating a new API token. This vulnerability can result in the execution of malicious code in the context of other users' sessions, compromising their accounts and enabling unauthorized actions. This vulnerability is fixed in 24.10.0.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 74% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librenms:librenms

References

https://github.com/librenms/librenms/commit/25988a937cbaebd2ba4c0517510206c404dfb359
https://github.com/librenms/librenms/security/advisories/GHSA-gfwr-xqmj-j27v

Check your stack JSON