CVE-2025-62411

Published: Oct 16, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored and later rendered in the Transports column of the Alert Rules page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser. This vulnerability is fixed in 25.10.0.

Affected (1)

Products: Librenms: Librenms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Librenms Librenms	Before 25.10.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/librenms/librenms/commit/706a77085f4d5964f7de9444208ef707e1f79450

Source: security-advisories@github.com

Patch

https://github.com/librenms/librenms/security/advisories/GHSA-frc6-pwgr-c28w

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/librenms/librenms/security/advisories/GHSA-frc6-pwgr-c28w

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.