Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36947LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection
High 7.1
In plain English
A high-severity SQL injection in LibreNMS from LibreNMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | no fix listed | GHSA-qp2j-v5jg-hg68 |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-49246 exploit
- LibreNMS Official Website product
- LibreNMS GitHub Repository product
- LibreNMS Community product
- VulnCheck Advisory: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection third-party-advisory