CVE-2026-26992: LibreNMS /port-groups name Stored Cross-Site Scripting

/port-groups name Stored Cross-Site Scripting

• HTTP POST
• Request-URI(s): “/port-groups”
• Vulnerable parameter(s): “name”
• Attacker must be authenticated with “admin” privileges.
• When a user adds a port group, an HTTP POST request is sent to the Request-URI “/port-groups”. The name of the newly created port group is stored in the value of the name parameter.
• After the port group is created, the entry is displayed along with some relevant buttons like Edit and Delete.