CVE-2025-62411

MEDIUM EPSS 95.5%
Published Oct 16, 20258mo ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Oct 16, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored and later rendered in the Transports column of the Alert Rules page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser. This vulnerability is fixed in 25.10.0.

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
95.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
librenmslibrenms* <25.10.0

References 2

  • github.com https://github.com/librenms/librenms/commit/706a77085f4d5964f7de9444208ef707e1f79450
    Patch
  • github.com https://github.com/librenms/librenms/security/advisories/GHSA-frc6-pwgr-c28w
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/librenms/librenms/commit/706a77085f4d5964f7de9444208ef707e1f79450
    Patch