CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.

• CWE-89

• https://github.com/librenms/librenms/blob/master/app/Http/Controllers/Widgets/TopDevicesController.phpThird Party Advisory
• https://github.com/librenms/librenms/issues/12405Third Party Advisory
• https://github.com/librenms/librenms/pull/12422Patch, Third Party Advisory
• https://github.com/librenms/librenms/releases/tag/21.1.0Release Notes, Third Party Advisory
• https://www.horizon3.ai/disclosures/librenms-second-order-sqliExploit, Third Party Advisory
• https://github.com/librenms/librenms/blob/master/app/Http/Controllers/Widgets/TopDevicesController.phpThird Party Advisory
• https://github.com/librenms/librenms/issues/12405Third Party Advisory
• https://github.com/librenms/librenms/pull/12422Patch, Third Party Advisory
• https://github.com/librenms/librenms/releases/tag/21.1.0Release Notes, Third Party Advisory
• https://www.horizon3.ai/disclosures/librenms-second-order-sqliExploit, Third Party Advisory

Published

Feb 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35685An issue was discovered in HCC Nichestack 3.0. The code that…9.1
• CVE-2020-35686The SECOMN service in Sound Research DCHU model software com…7.8
• CVE-2020-35687PHPFusion version 9.03.90 is vulnerable to CSRF attack which…4.3
• CVE-2020-3569Multiple vulnerabilities in the Distance Vector Multicast Ro…8.6
• CVE-2020-35693On some Samsung phones and tablets running Android through 7…8.8
• CVE-2020-35698Thinkific Thinkific Online Course Creation Platform 1.0 is a…6.1
• CVE-2020-35701An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL…8.8
• CVE-2020-35702DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a…7.8
• CVE-2020-35704Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35705Daybyday 2.1.0 allows stored XSS via the Name parameter to t…5.4
• CVE-2020-35706Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35707Daybyday 2.1.0 allows stored XSS via the Company Name parame…5.4