{"id":"CVE-2026-45694","title":"LibreNMS is a network monitoring system","summary":"LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"librenms","product":"librenms/librenms","affected":["librenms/librenms <= 26.4.0"],"patched":["librenms/librenms 26.5.0"],"published":"2026-08-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45694","references":[{"url":"https://github.com/librenms/librenms/commit/0be1bfd7746cea26bf7da40e82b70f75b724d0f8","label":"security-advisories@github.com"},{"url":"https://github.com/librenms/librenms/security/advisories/GHSA-jmqm-f8q4-v7wx","label":"security-advisories@github.com"},{"url":"https://github.com/librenms/librenms/releases/tag/26.5.0"},{"url":"https://github.com/advisories/GHSA-jmqm-f8q4-v7wx"}],"tags":["nvd","ghsa","composer"],"epss":0.00146,"epssPercentile":0.04223,"aliases":["GHSA-jmqm-f8q4-v7wx"],"ecosystem":"composer","ingestedAt":"2026-08-12T15:53:06.053Z","slug":"CVE-2026-45694","body":"## Overview\n\nLibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters are placed into the page title with only strip_tags applied, and the title is then written into an inline document.title assignment through string interpolation, so a single quote terminates the JavaScript string and the remaining input runs as script. An attacker who lures an authenticated user into following a crafted link can execute script in that user's session, enabling actions such as theft of session data. This issue is fixed in version 26.5.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-45694)\n\nAffected packages:\n\n- `librenms/librenms <= 26.4.0`\n\nPatched in:\n\n- `librenms/librenms 26.5.0`\n\nSource: https://github.com/advisories/GHSA-jmqm-f8q4-v7wx","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}