CVE-2020-15878: SQL Injection
Published Aug 26, 2026
·Updated
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint.
Affected Software
1 affected component
librenms librenms=1.65
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:16 PM
Description
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be remotely authenticated to LibreNMS and have normal user privileges. No administrative privileges are stated as necessary.
2
What information could be exposed if exploitation succeeds?
A successful SQL injection can allow extraction of all information in the LibreNMS database.
3
Which component receives the malicious input?
The issue is in the address parameter handled by the /ajax_table.php API endpoint.
4
Is a fixed release identified?
The provided references include the comparison from LibreNMS 1.65 to 1.65.1 and the 1.65.1 release, indicating that 1.65.1 is the referenced fixed release.