Description

I think your website is quite secure.

But you overlooked the HTML Injection vulnerability (ID:WSTG-CLNT-03 of OWASP).

Proof of Concept

1 .Login with demo account

2 .Access the link https://demo.librenms.org/search/search=ipv4 and insert the payload

      search=<b>test/b>

3 .Hit enter, html injection vulnerability detected

Proof of Concept

Video Poc

https://drive.google.com/file/d/1SKLGEsaeFXrWopBckrFcGRAG0N2RMoQA/view?usp=sharing

Impact

Credential theft: An attacker can use JavaScript code to obtain sensitive information from a user's browser, such as usernames, passwords, credit card information, and personal data. other.

Browser redirection: Attackers can redirect users to fake or malicious websites, often to scam users or install malware.

Change website content: An attacker can change the content of the affected website, causing confusion for users or creating fake messages.