Vulnerability · Published Oct 16, 2025 · Assigned by GitHub_M
CVE-2025-62411Stored XSS in Alert Transport name field in LibreNMS
Medium 5.5
In plain English
A medium-severity cross-site scripting in librenms from librenms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 13.3% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored and later rendered in the Transports column of the Alert Rules page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser. This vulnerability is fixed in 25.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | librenms/librenms | 25.10.0 | GHSA-frc6-pwgr-c28w |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N