CVE-2021-31274

In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.

• CWE-79

• https://community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431Vendor Advisory
• https://github.com/librenms/librenmsProduct, Third Party Advisory
• https://github.com/librenms/librenms/pull/12739Patch, Third Party Advisory
• https://community.librenms.org/t/vulnerability-report-cross-site-scripting-xss-in-the-api-access-page/15431Vendor Advisory
• https://github.com/librenms/librenmsProduct, Third Party Advisory
• https://github.com/librenms/librenms/pull/12739Patch, Third Party Advisory

Published

Sep 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31259The gf_isom_cenc_get_default_info_internal function in GPAC …5.5
• CVE-2021-31260The MergeTrack function in GPAC 1.0.1 allows attackers to ca…5.5
• CVE-2021-31261The gf_hinter_track_new function in GPAC 1.0.1 allows attack…5.5
• CVE-2021-31262The AV1_DuplicateConfig function in GPAC 1.0.1 allows attack…5.5
• CVE-2021-3127NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 ha…7.5
• CVE-2021-31272SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb…9.8
• CVE-2021-3128In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASU…7.5
• CVE-2021-31280An issue was discovered in tp5cms through 2017-05-25. admin.…6.1
• CVE-2021-3129Ignition before 2.5.2, as used in Laravel and other products…9.8
• CVE-2021-31291Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-31292An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 …7.5
• CVE-2021-31294Redis before 6cbea7d allows a replica to cause an assertion …5.9