# CVE-2020-15875: LibreNMS SQL injection in ajax_table.php

Source: https://junglewise.ai/threats/cve-2020-15875-librenms-sql-injection-in-ajax-table-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2020-15875 · Severity: medium · CVSS 5 · Published 2026-09-13

LibreNMS is a network monitoring and management platform used by organizations to track device health and network performance. An authenticated user with normal privileges can exploit a SQL injection vulnerability in the searchPhrase parameter to extract the entire database contents, potentially exposing sensitive network topology, device credentials, and monitoring data without administrative access.

Technologies: [Librenms](https://junglewise.ai/threats/technologies/librenms). Vendors: [Librenms](https://junglewise.ai/threats/vendors/librenms).

## Quick answers

**Is CVE-2020-15875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15875 being exploited in the wild.

**How severe is CVE-2020-15875?** Medium severity, with a CVSS score of 5, published 13 September 2026.

**Which products and versions are affected?** Librenms 1.65 and earlier.

**Is there a fix for CVE-2020-15875?** A patch was published on 2020-07-10: Fix committed to repository (github commit 32f72bc) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2020-15875?** Check whether you run Librenms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection in the searchPhrase parameter of the /ajax_table.php API endpoint, affecting multiple table processing includes. An authenticated remote attacker with normal user privileges can craft malicious input in the searchPhrase parameter to inject arbitrary SQL commands. The attack requires valid credentials but no special privileges, allowing extraction of all database contents. The vulnerability was patched in commit 32f72bc (July 10, 2020) which added input sanitization using parameterized queries to the affected parameters (searchPhrase, address, and sort).

## Affected products

- LibreNMS LibreNMS 1.65 and earlier

## Timeline

- 2020-09-13: disclosed
- 2020-07-10: patched: Fix committed to repository (github commit 32f72bc)

## References

- [https://community.librenms.org/c/announcements](https://community.librenms.org/c/announcements)
- [https://github.com/librenms/librenms/commit/32f72bc1ab7e980e4070e826a89d0d36a5ba62dd](https://github.com/librenms/librenms/commit/32f72bc1ab7e980e4070e826a89d0d36a5ba62dd)

## Related threats

- [LibreNMS LDAP filter injection in external authorization modes](https://junglewise.ai/threats/cve-2026-109357-librenms-before-26-9-0-contains-an-ldap-filter-injection-in-ldap)
- [LibreNMS missing authorization in PortsController::purge](https://junglewise.ai/threats/cve-2026-109356-librenms-before-26-9-0-contains-a-missing-authorization)
- [LibreNMS stored cross-site scripting in Oxidized node list](https://junglewise.ai/threats/cve-2026-109355-librenms-before-26-9-0-contains-a-stored-cross-site-scripting)
- [LibreNMS path traversal in NFSen channel parameter](https://junglewise.ai/threats/cve-2026-109354-librenms-before-26-9-0-contains-a-path-traversal-vulnerability)
- [LibreNMS SQL injection in notifications.inc.php](https://junglewise.ai/threats/cve-2026-109353-librenms-before-26-9-0-contains-an-sql-injection-vulnerability)