VULNERABILITY INTELLIGENCE

CVE-2020-36947

CVSS score7.1 HIGH
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-01-27
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.

Weakness classification

  • disclosure@vulncheck.com: CWE-89

Primary references