What is GHSA-qp2j-v5jg-hg68?

GHSA-qp2j-v5jg-hg68 is a security advisory published by GitHub Security Advisories with High severity. LibreNMS contains an authenticated SQL Injection vulnerability

Which CVE IDs does GHSA-qp2j-v5jg-hg68 cover?

GHSA-qp2j-v5jg-hg68 covers the following CVE IDs: CVE-2020-36947. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qp2j-v5jg-hg68?

GHSA-qp2j-v5jg-hg68 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-qp2j-v5jg-hg68?

GHSA-qp2j-v5jg-hg68 affects 1 product, including: composer/librenms/librenms:\u003c= 1.46.

GHSA-qp2j-v5jg-hg68HighCVSS 7.1

LibreNMS contains an authenticated SQL Injection vulnerability

Vendor

GitHub Security Advisories

Published

January 27, 2026

Last Modified

February 2, 2026

🔗 CVE IDs covered (1)

CVE-2020-36947 →

📋 Description

LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.

🎯 Affected products1

composer/librenms/librenms:<= 1.46

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-36947
https://community.librenms.org
https://github.com/librenms/librenms
https://www.exploit-db.com/exploits/49246
https://www.vulncheck.com/advisories/librenms-mac-accounting-graph-authenticated-sql-injection
https://github.com/advisories/GHSA-qp2j-v5jg-hg68