CVE-2020-35700: Librenms

High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days.

A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.

Affected products

• Librenms Librenms: before 21.1.0 (fixed in 21.1.0)

Published 2021-02-08. Last modified 2026-06-17.