4.3med
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Also known as GHSA-c89f-8g7g-59wj
Published 10 mo ago · modified 18 d ago · JSON
CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
3.9%
percentile 90%
Public exploits
0
none known
Summary
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject HTML code. This issue has been patched in version 25.12.0.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction (EPSS)
3.88% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | librenms/librenms | <25.12.0 | 25.12.0 |
Affected products
- librenms librenms
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- github.com /librenms/librenms/security/advisories/GHSA-c89f-8g7g-59wj · x_refsource_CONFIRM
- github.com /librenms/librenms/commit/ebe6c79bf4ce0afeb575c1285afe3934e44001f1 · x_refsource_MISC
- nvd.nist.gov /vuln/detail/CVE-2025-68614 · advisory
- github.com /librenms/librenms · package
Sources
- CVE List: CVE-2025-68614
- GitHub Advisory: GHSA-c89f-8g7g-59wj
- NVD: CVE-2025-68614
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.