CVE-2019-10666 - CVE House
Back to Database
Status published High CVE-2019-10666

An issue was discovered in LibreNMS through 1.47. Several of...

Vulnerability Description

An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10666

Credits & Attribution

No credits recorded in the NVD database.

References

More from librenms

View All →
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Medium 4.3
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
Medium 5.5
CVE-2025-65014
LibreNMS has Weak Password Policy
Low 3.7
CVE-2025-65013
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
Medium 6.2
CVE-2025-62412
LibreNMS alert-rules Cross-Site Scripting Vulnerability
Low 3.8

Affected Vendor

Affected Software

librenms
Vulnerable Versions:
0

Timeline

Official Publish: September 9th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.