A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| librenms/librenms(Packagist) | 0 | 21.1.0 | N/A |
CVSS Metrics
