CVE-2025-62411
Medium · 5.5LibreNMS has a Stored XSS vulnerability in its Alert Transport name field
CVSS
5.5
EPSS
12.7%
Published
Oct 16, 2025
CISA due date
—
The record
LibreNMS <= 25.8.0 contains a **Stored Cross-Site Scripting (XSS)** vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the `Transport name` field is stored and later rendered in the **Transports** column of the **Alert Rules** page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | librenms/librenms | 0 | 25.10.0 |
Related vulnerabilities
- CVE-2024-51092 LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command… Also affects librenms/librenms
- CVE-2026-26992 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26991 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-27016 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26989 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26990 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms
- CVE-2026-26987 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Also affects librenms/librenms