CVE-2026-2728
CVE-2026-2728
Vexday Risk Score
33Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 4.6EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
13 Apr 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against other users with access to the page.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected products
librenms · librenmspublic PoCs found — 1
cve_referenceprojectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showconfig-page-2630unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →