PT-2025-33678 · Librenms · Librenms

At4111 · Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-55296

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: librenms versions prior to 25.8.0

Description: A stored Cross-Site Scripting (XSS) issue exists in LibreNMS in the Alert Template creation feature. This allows a user with admin privileges to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts.

Recommendations: Update to version 25.8.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-55296

GHSA-VXQ6-8CWM-WJ99

Affected Products

Librenms

References · 10

• 🔥 https://github.com/librenms/librenms/security/advisories/GHSA-vxq6-8cwm-wj99 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55296.json · Exploit
• https://github.com/librenms/librenms/commit/8ade3d827d317f5ac4b336617aafff865f825958 · Patch
• https://osv.dev/vulnerability/CVE-2025-55296 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxq6-8cwm-wj99 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55296 · Security Note
• https://github.com/librenms/librenms · Note
• https://twitter.com/VulmonFeeds/status/1957536599396282419 · Twitter Post
• https://twitter.com/CVEnew/status/1957500988778021026 · Twitter Post
• https://t.me/CVEtracker/30294 · Telegram Post