THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jmqm-f8q4-v7wx (medium) — LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

[GHSA] GHSA-jmqm-f8q4-v7wx (medium) — LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

highgithub_advisoriesPublished 2026-08-12

GHSA-jmqm-f8q4-v7wx Severity: medium CVE: CVE-2026-45694

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

### Summary `LegacyController.php:75` writes the page title into a `document.title` JS assignment using string interpolation. `apps/proxmox.inc.php` pushes `$vars['instance']` and `$vars['vmid']` (GET params, only `strip_tags

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-45694cve
http://target/apps?app=proxmox&instance=%27%3Balert%28document.cookie%29%3B//url

Original source: https://github.com/advisories/GHSA-jmqm-f8q4-v7wx