Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-20 | 4 | Disclosure3Patch1 |
| 2026-02-25 | 1 | Disclosure1 |
CVE-2026-26990 Time-Based Blind SQL Injection in LibreNMS Address Search Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26990
Post summary
This brief notice announces a new CVE, CVE-2026-26990, describing a time-based blind SQL injection flaw in LibreNMS's address search module, but provides no PoC, exploit code, or mitigation details.
CVE-2026-26990 (CVSS:8.8, HIGH) is Analyzed. LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Bas..https://nvd.nist.gov/vuln/detail/CVE-2026-26990 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post reports on CVE-2026-26990, noting its high severity (CVSS 8.8) and affected LibreNMS versions, but provides no PoC, exploit, or patch details.
[CVE-2026-26990: HIGH] LibreNMS network monitoring tool had Time-Based Blind SQL Injection vulnerability in versions 25.12.0 and below, fixed in version 26.2.0. Ensure prompt updates for cyber security.#cve,CVE-2026-26990,#cybersecurity https://cvefind.com/CVE-2026-26990
Post summary
The text announces a Time‑Based Blind SQL Injection flaw (CVE‑2026‑26990) in LibreNMS that has been fixed in v26.2.0 and recommends users to update promptly.
CVE-2026-26990 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in addres… https://www.cve.org/CVERecord?id=CVE-2026-26990
Post summary
CVE‑2026‑26990 exposes a Time‑Based Blind SQL Injection in LibreNMS versions 25.12.0 and earlier; the vulnerability is described but not linked to PoC, exploit code, or active attacks.
🟠 CVE-2026-26990 - High LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in http://address-search.inc.php via the ... https://www.thehackerwire.com/vulnerability/CVE-2026-26990/ https://t.co/SdXJx2ExMT
Post summary
The post discloses a time‑based blind SQL injection flaw in LibreNMS 25.12.0 and earlier, specifically through address-search.inc.php, but does not provide PoC code, exploit details, patch information, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | librenms | librenms | - | - | - |