CVE-2020-36947
LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection
- State
- Published
- Severity
- 7.1 High
- Published
- Jan 27, 2026
- Updated
- Oct 8, 2026
- Reserved
- Jan 25, 2026
Description
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
LibreNMSLibreNMS |
|
References
- ExploitDB-49246exploit
- LibreNMS Official Websiteproduct
- LibreNMS GitHub Repositoryproduct
- LibreNMS Communityproduct
- VulnCheck Advisory: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.