CVE-2024-47526

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.

• CWE-79

• https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40Product
• https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205Product
• https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5Patch
• https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52Exploit, Product

Published

Oct 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4752The EventON WordPress plugin before 2.2.15 does not sanitise…5.9
• CVE-2024-47520A user with advanced report application access rights can pe…7.6
• CVE-2024-47522Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-47523LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-47524LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…4.8
• CVE-2024-47525LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-47527LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-47528LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…4.8
• CVE-2024-47529OpenC3 COSMOS provides the functionality needed to send comm…6.5
• CVE-2024-4753The WP Secure Maintenance WordPress plugin before 1.7 does n…4.8
• CVE-2024-47530Scout is a web-based visualizer for VCF-files. Open redirect…6.1
• CVE-2024-47531Scout is a web-based visualizer for VCF-files. Due to the la…3.5