CVE-2026-109353
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Oct 12, 2026
Vendor
unknown
Description
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.