PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LibreNMS < 26.3.0 Authenticated RCE & XSS

projectblack.io | research | #rce | #web-security | #xss | #librenms | #authenticated
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Searching for unsafe patterns revealed authenticated XSS and RCE in LibreNMS before 26.3.0, including an arbitrary file write path and abuse of configurable binary locations to run code.
Published
Collected

Related coverage

research · projectblack.io
LibreNMS Authenticated RCE (< 26.5.0)
The second LibreNMS post: an unsanitised exec call in the Libvirt discovery module allows authenticated RCE, plus alternative paths via writable binaries and composer wrapper argument injection.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
Back