Log in Start free

Vulnerability · Published May 17, 2025 · Assigned by GitHub_M

CVE-2025-47931LibreNMS stored Cross-site Scripting vulnerability in poller group name

Low 2.1

In plain English

A low-severity cross-site scripting in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.1% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)10.1%top 4.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistlibrenms/librenms25.5.0GHSA-hxw5-9cc5-cmw5

Affected products (as reported)

VendorProductVersions
librenms librenms < 25.5.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References