CVE-2025-62412

MEDIUM EPSS 16.4%
Published Oct 16, 20258mo ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Oct 16, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

LibreNMS is a community-based GPL-licensed network monitoring system. The alert rule name in the Alerts > Alert Rules page is not properly sanitized, and can be used to inject HTML code. This vulnerability is fixed in 25.10.0.

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
16.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
librenmslibrenms*≥25.8.0  –  <25.10.0

References 2

  • github.com https://github.com/librenms/librenms/commit/dccdf6769976a974d70f06a7ce8d5a846b29db6f
    Patch
  • github.com https://github.com/librenms/librenms/security/advisories/GHSA-6g2v-66ch-6xmh
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/librenms/librenms/commit/dccdf6769976a974d70f06a7ce8d5a846b29db6f
    Patch